Home page logo

pen-test logo Penetration Testing mailing list archives

Re: how an hacker can bypass a chrooted environement ?
From: Tonnerre Lombard <tonnerre.lombard () sygroup ch>
Date: Sat, 13 May 2006 06:57:02 +0100


On Fri, 2006-05-12 at 11:37, Norbert Fran?ois wrote:
I was wondering how an attacker can bypass a chrooted environement. A
(common) technique consist in finding a vulnerable program (in the
chrooted environnement) and injecting it a shellcode (i.e
../../../../../../../bin/bash for ex.)  by BoF.  But normally, in the
chrooted environement, you volontarily add only necessary tools (like
ls, cat, less...), and vulnerable softwares are uncommon...

So... how do they this "exploit" of bypassing the chroot ?

For example by getting a dir file descriptor from "outside" and
fchrooting to that one.

SyGroup GmbH
Tonnerre Lombard

Loesungen mit System
Tel:+41 61 333 80 33    Roeschenzerstrasse 9
Fax:+41 61 383 14 67    4153 Reinach
Web:www.sygroup.ch      tonnerre.lombard () sygroup ch

Attachment: signature.asc
Description: This is a digitally signed message part

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]