On: Linux Local Privilege Escalation via SUID /proc/pid/mem Write

[kmm]

On my system, all SUID binaries are executable yet not readable, e.g.

  $ ls -l /bin/su
  -rws--x--x 1 root root 52144 Mar  5  2011 /bin/su

Doesn't this effectively stop the exploit? It still works when I insert the <exit@plt> function address, but I don't think it's possible to trace this without root rights, which kind of defeats the purpose.

[rzhou → kmm]

It doesn't stop the exploit, as it is still possible to use ptrace to essentially dump the binary, even though it's not readable.

[ahv → rzhou]

Or if you know the distro, it is trivial to get the package containing the su executable and locate the address.

[kmm → ahv]

I compiled it myself, so that is not an option.

[burgerbrain → kmm]

Presumably they only need to guess the flags you used then. There is really not all that much entropy there.

And I suspect doing so is fairly uncommon in production environments anyway.