mailing list archives
Re: how an hacker can bypass a chrooted environement ?
From: Tonnerre Lombard <tonnerre.lombard () sygroup ch>
Date: Sat, 13 May 2006 06:57:02 +0100
On Fri, 2006-05-12 at 11:37, Norbert Fran?ois wrote:
I was wondering how an attacker can bypass a chrooted environement. A
(common) technique consist in finding a vulnerable program (in the
chrooted environnement) and injecting it a shellcode (i.e
../../../../../../../bin/bash for ex.) by BoF. But normally, in the
chrooted environement, you volontarily add only necessary tools (like
ls, cat, less...), and vulnerable softwares are uncommon...
So... how do they this "exploit" of bypassing the chroot ?
For example by getting a dir file descriptor from "outside" and
fchrooting to that one.
Loesungen mit System
Tel:+41 61 333 80 33 Roeschenzerstrasse 9
Fax:+41 61 383 14 67 4153 Reinach
Web:www.sygroup.ch tonnerre.lombard () sygroup ch
Description: This is a digitally signed message part