The Following User Says Thank You to gionni88 For This Useful Post: | ||
![]() |
2011-06-29
, 19:34
|
Posts: 34 |
Thanked: 10 times |
Joined on Feb 2010
@ Moscow, Russia
|
#232
|
The solution (I havent confirmed with AngryMasterYoda yet) is to check your /etc/sudoers file and see if the line:
'Defaults env_keep+=GTK_MODULES
user ALL = NOPASSWD: ALL'
The Following User Says Thank You to Angry Master Yoda For This Useful Post: | ||
![]() |
2011-06-29
, 22:56
|
Posts: 3 |
Thanked: 1 time |
Joined on Feb 2007
|
#233
|
![]() |
2011-06-30
, 08:46
|
Posts: 309 |
Thanked: 519 times |
Joined on Oct 2010
|
#234
|
![]() |
2011-06-30
, 10:01
|
Posts: 136 |
Thanked: 150 times |
Joined on Dec 2010
@ Finland
|
#235
|
![]() |
2011-06-30
, 22:34
|
Posts: 34 |
Thanked: 10 times |
Joined on Feb 2010
@ Moscow, Russia
|
#236
|
I'll release an update by Saturday that uses gioni88's method of exploiting rootsh directly.
![]() |
2011-07-01
, 08:55
|
Posts: 309 |
Thanked: 519 times |
Joined on Oct 2010
|
#237
|
![]() |
2011-07-01
, 23:58
|
Posts: 309 |
Thanked: 519 times |
Joined on Oct 2010
|
#238
|
The Following User Says Thank You to tetris11_ For This Useful Post: | ||
![]() |
2011-07-08
, 02:34
|
Posts: 3 |
Thanked: 0 times |
Joined on Jul 2011
|
#239
|
![]() |
2011-07-08
, 08:38
|
Posts: 309 |
Thanked: 519 times |
Joined on Oct 2010
|
#240
|
If you wanna exploit rootsh, you must do this:
"echo 'COMMAND TO LAUNCH WITH ROOT PRIVS' | root"
If you wanna do it in a proper way, you have to copy YOUR sudoers file into /etc/sudoers.d dir which enables "sudo ifconfig" to be run without asking for password.
'Defaults env_keep+=GTK_MODULES
user ALL = NOPASSWD: ALL'
Is added by package easy-chroot, and will enable any sudo command for any user to be run without asking for password. If you wanna "exploit" it, add easy-chroot into deps, but it's not a so smart idea imo.
Another hint, touching /etc/sudoers file directly is a REAAAALY bad idea, never do it, or you may brick your sudoers. A good way is to add a file into sudoers.d dir and run "update-sudoers" as root after doing it.
About my ssh -X: if I don't add that option the ssh command fail since there is no X window forwarding. I'll wait for your script, cheers.