Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: No shell => secure?
From: "Wall, Kevin" <Kevin.Wall () qwest com>
Date: Fri, 9 Jul 2004 12:30:59 -0500

Matthias Benkmann wrote...

I can't say I've looked at much exploit-code so far but the POC exploits
to gain root I've seen for Linux all executed /bin/sh. I'd like to know if
this is true for in-the-wild exploits to root a box, too. If so, would it
be a useful security measure to rename /bin/sh and other shells (after
making sure that everything that needs them has been updated to the new
name, of course)?

No; sometimes they use other shells, such as /bin/bash, /bin/ash,
/bin/zsh, etc. or else execute a single command at a time.

Also, presumably, you'd still have to set SHELL env variable, so
they could presumably just execute $SHELL in many cases.

Worst of all, you now have yourself a maintenance nightmare. Think
of how many shell scripts where you'd have to change the


to whatever full path name you've switched the shell to. And you'd have
to do this whenever you install a vendor update, an RPM, etc.

Yuck! No thanks!

I'm aware that a dedicated attacker who targets my box specifically will
not be stopped by this but I don't think I have such enemies. I also know
that DOS is still possible, but that's also not my concern. I'm simply
worried about script kiddies using standard exploits against random
servers on the Internet rooting my box faster than I can patch it.

Well, it probably would stop the script kiddies--for awhile at least.
But see above.

Also, if you keep on top of patches, have appropriate firewall rules
and other access control mechanisms in place, script kiddies are
not all that hard to keep out.

If renaming the shell is not enough, how about renaming all of the
standard Unix top-level directories (such as /bin, /etc,...)? Would that
defeat standard exploits to root a box?

Man, that would REALLY become a maintenance nightmare. You'd have to
customize almost all RPMs, vendor patches, etc. before installing
-kevin wall
Qwest IT - Application Security Team
"The reason you have people breaking into your software all 
over the place is because your software sucks..."
 -- Former whitehouse cybersecurity advisor, Richard Clarke,
    at eWeek Security Summit

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]