Hack Security Pro.pdf - Index of

This program is “suidroot”, which means that whoever the user is, it is executed with the rights of the
super-user.
This program verifies the user's rights, so it goes without saying that to write in a file with “root” as
owner user whose rights are -rw-r—r--, the executing user must also have super-user rights.
The program functions in the following manner
– The first instruction checks the user's rights, and if the user does not have the necessary rights,
the execution stops and it is impossible to write in the file. If the user has the rights to this file, we
then move on to the following instruction.
– The program opens the file to write.
– The program writes the character chain in the file.
Now let us imagine that we create a file called “switch” ( as a non-privileged user) and a “target” file (as
a super user).
As a non privileged user, we have writing rights on the “switch” file but not on the “target” file.
If we use the “race” program to write any chain of characters in the switch file, there will be no
problems. However if we try to write in the “target” file, the program will refuse.
So the idea is to modify “switch” between the verification of rights instruction and the opening of file
instruction so that the “switch” file be replaced by a symbolic link on the “target” file; this way we can
bypass the verification of rights (this verification of rights is done on the “switch” file, which in the
meantime is replaced by a link on “target”) and so we can write in the “target” file, something that is
normally forbidden.
Example
Instruction of cecking users rights
Instruction of openung file
Instruction of writting file
Exploitation possibility
The Hackademy DMP -161/209- SYSDREAM