Local Exploit Issue with:
The urpmi executable (perl script)
[root@localhost /root]# ls -al /usr/bin/urpmi
-rwsr-x--- 1 root urpmi 9352 Apr 4 2000 /usr/bin/urpmi*
This requires an account in the urpmi group. Possibly physical access to the box as well.
On Mandrake 7.1 the package urpmi was installed by default on my machine... I did not add my user to the urpmi group
gid 234(urpmi) it was like that when the user was added to my system. As you can see in the config file a User is aloud to install a
package if it resides in a directory that has been defined as being safe.
[root@localhost /root]# cat /etc/urpmi/urpmi.cfg
urpmi enables non-superuser install of rpms. In fact, it
only authorizes well-known rpms to be installed.
All users belonging to group urpmi are allowed to install
Just launch urpmi followed by what you think is the name
of the package(s), and urpmi will install them
^---------- hrmm so lets say I have supermount enabled on my box
And my fstab looks something like this and of course the mtab having the appropreate entry also.
/dev/cdrom /mnt/cdrom auto user,noauto,nosuid,exec,nodev,ro 0 0
So I decide to burn myself a cd with a folder RPMS and I place exploitmeplease.i586.rpm in the folder.
Simply drop it in the cdrom drive and viola.
I should then as a member of the urpmi group be alloud to type:
[user@localhost /mnt/cdrom/RPMS]$ urpmi -ivh exploitmeplease
And procede to install my tools as root
Note that urpmi handle installations from various medias
(ftp, local and nfs volumes, removable medias such as
CDROMs) and is able to install dependencies from a media
different from the package's media. If necessary, urpmi
asks you to insert the required media.
^---------- thats cool it might even ask me to put in a cd... hrmm thats a bright idea. trojan dependancys for a package
you do have access to could be located on a different cd... thats really anal but theoretically it could happen.
Hell for all I know if you got lucky and there was a blank in the drive or if you can physically put a blank in the drive
you could maybe use the cdwriter exploit to burn your trojan cd.