2KKUU7ita

Chapter 12: Linux
Manual testing
The following commands can identify and print to the screen SetUID and
SetGID programs:
✓ Programs that are configured for SetUID:
find / -perm -4000 –print
✓ Programs that are configured for SetGID:
find / -perm -2000 –print
✓ Files that are readable by anyone in the world:
find / -perm -2 -type f –print
✓ Hidden files:
find / -name “.*”
You probably have hundreds of files in each of these categories, so don’t be
alarmed. When you discover files with these attributes set, you need to make
sure that they are actually supposed to have those attributes by researching
in your documentation or on the Internet, or by comparing them to a known
secure system or data backup.
Keep an eye on your systems to detect any new SetUID or SetGID files that
suddenly appear.
Automatic testing
You can use an automated file-modification auditing program to alert you
when these types of changes are made. This is what I recommend — it’s a lot
easier on an ongoing basis:
✓ A change-detection application, such as Tripwire, can help you keep
track of what changed and when.
✓ A file-monitoring program, such as COPS (point your web browser to
ftp://ftp.cerias.purdue.edu/pub/tools/unix/scanners/
cops), finds files that have changed in status (such as a new SetUID or
removed SetGID).
Finding Buffer Overflow Vulnerabilities
RPC and other vulnerable daemons are common targets for buffer-overflow
attacks. Buffer-overflow attacks are often how the hacker can get in to modify
system files, read database files, and more.
243