View Single Post
wicket's Avatar
Posts: 634 | Thanked: 3,266 times | Joined on May 2010 @ Colombia
#130
The second thing I discovered was that it is actually possible to run an incepted opensh shell as a regular user and gain full root privileges without needing to supply a root password!

Code:
~ $ /usr/sbin/aegisctl
+esdrtxk,-az
~ $ accli -I | grep -v IMEI
Current mode: normal
Credentials:
        UID::user
        GID::users
        GRP::adm
        GRP::dialout
        GRP::pulse-access
        GRP::users
~ $ opensh


BusyBox v1.20.0.git (MeeGo 3:1.20-0.1+0m7) built-in shell (ash)
Enter 'help' for a list of built-in commands.

/home/user # id -un
root
/home/user # id -unr
root
/home/user # accli -I | grep -v IMEI
Current mode: normal
Credentials:
        UID::root
        GID::root
        CAP::chown
        CAP::dac_override
        CAP::dac_read_search
        CAP::fowner
        CAP::fsetid
        CAP::kill
        CAP::setgid
        CAP::setuid
        CAP::linux_immutable
        CAP::net_bind_service
        CAP::net_broadcast
        CAP::net_admin
        CAP::net_raw
        CAP::ipc_lock
        CAP::ipc_owner
        CAP::sys_module
        CAP::sys_rawio
        CAP::sys_chroot
        CAP::sys_ptrace
        CAP::sys_pacct
        CAP::sys_admin
        CAP::sys_boot
        CAP::sys_nice
        CAP::sys_resource
        CAP::sys_time
        CAP::sys_tty_config
        CAP::mknod
        CAP::lease
        CAP::audit_write
        CAP::audit_control
        CAP::setfcap
        CAP::mac_override
        CAP::mac_admin
        GRP::root
        GRP::daemon
        GRP::bin
        GRP::sys
        GRP::adm
        GRP::tty
        GRP::disk
        GRP::lp
        GRP::mail
        GRP::news
        GRP::uucp
        GRP::man
        GRP::proxy
        GRP::kmem
        GRP::dialout
        GRP::fax
        GRP::voice
        GRP::cdrom
        GRP::floppy
        GRP::tape
        GRP::sudo
        GRP::audio
        GRP::dip
        GRP::www-data
        GRP::backup
        GRP::operator
        GRP::list
        GRP::irc
        GRP::src
        GRP::gnats
        GRP::shadow
        GRP::utmp
        GRP::video
        GRP::sasl
        GRP::plugdev
        GRP::staff
        GRP::games
        GRP::libuuid
        GRP::pulse
        GRP::pulse-access
        GRP::pulse-rt
        GRP::cal
        GRP::users
        GRP::input
        GRP::i2c
        GRP::adc
        GRP::upstart
        GRP::crypto
        GRP::metadata-users
        GRP::phonet
        GRP::csd
        GRP::messagebus
        GRP::acm
        GRP::gallerycoredata-users
        GRP::signon
        GRP::osa
        GRP::calendar
        GRP::libaccounts-noa
        GRP::lpm
        GRP::visualreminder
        GRP::location
        GRP::nfc
        GRP::slpgwd
        GRP::haldaemon
        GRP::powerdev
        GRP::developer
        GRP::ssh
        GRP::spool
        GRP::nogroup
        tcb
        libbb5-secbins::SEE_CCCWrite
        libbb5-secbins::SEE_DBIWrite
        libbb5-secbins::SEE_HWCWrite
        libbb5-secbins::SEE_NPCWrite
        libbb5-secbins::SEE_SecStorageMaintenance
        libbb5-secbins::SEE_SuperDongleWrite
        libbb5-secbins::SEE_SuperDongleOperation
        libbb5-secbins::SEE_SimLock3Write
        libbb5-secbins::SEE_SimLock3Operation
        libbb5-secbins::SEE_TerminalResponce
        libbb5-secbins::SEE_DeviceLockControl
        aegis-enabler::tcb-sign
        tracker::tracker-extract-access
        tracker::tracker-miner-fs-access
        libaccounts-noa::accesssvt
        package-manager::packagemanager_limited
        package-manager::packagemanager_private
        icd2::icd2-plugin
        Cellular
        TrackerReadAccess
        TrackerWriteAccess
        Location
        FacebookSocial
        csd-base::csd-plugin
        mce::CallStateControl
        mce::DeviceModeControl
        mce::LEDControl
        mce::TKLockControl
        mce::SensorControl
        dsme::DeviceStateControl
        usb-moded::usb-moded-dbus-bind
        usb-moded::USBControl
        aegisfs::AegisFSMountAdd
        aegisfs::aegisfs-verify
        timed::TimeControl
        timed::TimeBackup
        timed::TimedEventQueueWrite
        bme::BatteryControl
        phonet-at::acm-plugin
        applauncherd-launcher::access
        libaccounts-glib0::accounts-glib-access
        libaccounts-glib0::t
        libaccounts-glib0::tok
        smartsearch::RelevanceAllContentTypes
        signond::keychain-access
        signond::ssoProtectedWriteAccess
        signond::ssoProtectedReadAccess
        account-plugin-ovi::noaaccess
        account-plugin-ovi::sso-encryption-token
        caldav-plugin::access
        account-plugin-caldav::sso-encryption-token
        account-plugin-caldav::caldav-access
        account-plugin-facebook::sso-encryption-token
        account-plugin-facebook::access-control
        account-plugin-flickr::flickr-access
        account-plugin-google::sso-encryption-token
        account-plugin-google::access-control
        account-plugin-sip::sso-encryption-token
        account-plugin-sip::access-control
        account-plugin-twitter::sso-encryption-token
        account-plugin-twitter::access-control
        account-plugin-youtube::sso-encryption-token
        account-plugin-youtube::access-control
        aegis-certman-common-ca::CertCACommonAdd
        aegis-certman-common-ca::CertCAGlobalCodeSignAdd
        aegis-certman-common-ca::CertCASSLAdd
        aegis-certman-common-ca::CertCAWifiAdd
        aegis-certman-common-ca::CertCASMIMEAdd
        aegis-certman-common-ca::CertCACodeSignAdd
        aegis-certman-common-ca::CertUserSSLUse
        aegis-certman-common-ca::CertUserWifiUse
        aegis-certman-common-ca::CertUserSMIMEUse
        aegis-certman-common-ca::CertCACodeSignUse
        devicelock::ProvisioningSettings_PasswordForceChange
        devicelock::ProvisioningSettings_MinimalDeviceWipeTypeRequired
        devicelock::ProvisioningSettings_RnD_additional_Debug
        devicelock::DeviceLock_SetPassword
        devicelock::DeviceLockServiceOwn
        devicelock::DeviceLockStorageAccess
        devicelock::State_Unlocked
        devicelock::State_Locked
        devicelock::State_WipeMMC
        devicelock::State_Inhibit
        devicelock::DeviceLockControl
        devicelock::SSO_Exchange
        backup-framework::backup
        libaegis-session::aegis-session-data
        clean-device::CUDOrRFS
        system-ui-screenlock-nokia::ScreenLockEventPublish
        call-ui::call-ui
        duicontrolpanel-certificatesapplet::encryptedDBusMessages
        facebookqml::facebook-token
        mfe-account-ui-plugins::mfe-access
        mfe-account-ui-plugins::sso-encryption-token
        mms-manager::MmsProtectedWriteAccess
        mms-manager::MmsProtectedReadAccess
        mms-manager::MmsWorkerAccess
        libodnp::odnp
        libslpgw::slpgw
        location-ui::location-ui
        messaging-ui::messaging-ui
        ope-service0::OpeWapUtilAccess
        positioningd::LocationControl
        odnp-fpcd::odnp-fpcd
        signon-default-key-extension::key-storage
        signon-ui::signond-access
        telepathy-sasl-signon::sso-encryption-token
        telepathy-spirit::telepathy-spirit
        grob::grob-access
        grob::sso-encryption-token
        groovem-account-ui-plugins::groovem-access
        groovem-account-ui-plugins::sso-encryption-token
        nfcd::ui-agent
        nfcd::tool
        omb0::omb-communication
        npe-maemo0::LocationFW
        opensh::opensh
        SRC::com.nokia.maemo/local
        AID::com.nokia.maemo/local.opensh.
        account-plugin-skype::skype-access
        account-plugin-skype::sso-encryption-token
This is obviously a huge security hole. I'd also like know if this problem occurs when running opensh under an open-mode kernel.

I suggest that anyone using an incepted opensh locks down both /bin/opensh and /bin/open-sh executables with 700 permissions until this is sorted.