mailing list archives
Re: /etc/passwd corruption
From: John Jacobs <flamdugen () hotmail com>
Date: Tue, 25 Jan 2011 14:21:52 -0600
On ubuntu lucid, I found a way to add corrupted entries to /etc/passwd
e.g. "AAA\n", but not to /etc/shadow. Does someone know a way to use
that for privilege escalation? What is the "+" line handling in
Please see "man 5 passwd", I suspect you'll be able to leverage this to
create a system account in /etc/passwd. The file will likely need to contain
a crypt()'d password. Not exactly sure how PAM will handle.
The Ubuntu gents are normally really good about fixing security issues so
you'll likely want to get in touch with them so they can fix it up.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/