From owner-freebsd-hackers Wed Jun 26 13:55:16 1996 Return-Path: owner-hackers Received: (from root@localhost) by freefall.freebsd.org (8.7.5/8.7.3) id NAA11034 for hackers-outgoing; Wed, 26 Jun 1996 13:55:16 -0700 (PDT) Received: from mercury.gaianet.net (root@mercury.gaianet.net [206.171.98.26]) by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id NAA11024; Wed, 26 Jun 1996 13:55:12 -0700 (PDT) Received: (from vince@localhost) by mercury.gaianet.net (8.7.5/8.6.12) id NAA03044; Wed, 26 Jun 1996 13:55:05 -0700 (PDT) Date: Wed, 26 Jun 1996 13:55:05 -0700 (PDT) From: -Vince- To: "Michael L. VanLoon -- HeadCandy.com" cc: "Eric J. Schwertfeger" , Mark Murray , hackers@freebsd.org, security@freebsd.org, Chad Shackley , jbhunt Subject: Re: I need help on this one - please help me track this guy down! In-Reply-To: <199606260511.WAA00500@MindBender.HeadCandy.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-hackers@freebsd.org X-Loop: FreeBSD.org Precedence: bulk On Tue, 25 Jun 1996, Michael L. VanLoon -- HeadCandy.com wrote: > >On Tue, 25 Jun 1996, Eric J. Schwertfeger wrote: > >> On Tue, 25 Jun 1996, -Vince- wrote: > > >> > Yeah, you have a point but jbhunt was watching the user as he > >> > hacked root since he brought the file from his own machine.... so that > >> > wasn't something the admin was tricked into doing.. > > >> Then the important question is, how did he move the file so that it > >> retained the setuid bit? We're already pretty sure that the program is > >> only /bin/sh with the setuid bit turned on. So either he found a way to > >> move the file with the bit turned on, or he found a way to turn it on, > >> which reqires root access. > > > It was a remote login so he had to transfer it over somehow... > > Well, *if* that's true, it still wouldn't be setuid root just from the > transfer. He'd *still* have to get root some other way to make this > binary setuid root. > > But if he's going to do that, why bother copying a binary over the > network -- it would just be easier to just snag a copy of your own > /bin/sh and mark it setuid root. Hmmm, what happens if he tars it first and then sends it over? Vince