Unfortunately, I dont seem to understand one minor concept in the "Art of Exploitation" book, concerning heap overflow: a new root shell is being added to the passwd file. From page 168:
However, the nature of this particular heap overflow exploit won’t allow that exact line to be written to
/etc/passwd
, because the string must end with/etc/passwd
. However, if that filename is merely appended to the end of the entry, the passwd file entry would be incorrect. This can be compensated for with the clever use of a symbolic file link, so the entry can both end with/etc/passwd
and still be a valid line in the password file. Here’s how it works:reader@hacking:~/booksrc $ mkdir /tmp/etc reader@hacking:~/booksrc $ ln -s /bin/bash /tmp/etc/passwd reader@hacking:~/booksrc $ ls -l /tmp/etc/passwd lrwxrwxrwx 19 2007-09-09 16:25 /tmp/etc/passwd -> /bin/bash
Now
/tmp/etc/passwd
points to the login shell /bin/bash. This means that a valid login shell for the password file is also/tmp/etc/passwd
, making the following a valid password file line:myroot:XXq2wKiyI43A2:0:0:me:/root:/tmp/etc/passwdThe values of this line just need to be slightly modified so that the portion before
/etc/passwd
is exactly 104 bytes long:
I understand the part when the author states that
/tmp/etc/passwd
can be used to link to/bin/bash
, but I don't understand how this really works (there is no explanation ofmkdir
,ln -s
etc)Also, this is probably very simple, but why does the author state that: "the values of this line just need to be slightly modified so that the portion before
/etc/passwd
is exactly 104 bytes long"? Why was/tmp
omitted in the previous line (i.e. why isn't it stated: "the portion before/tmp/etc/passwd
is exactly 104 bytes long" ? On the next page, the new root account is written to/etc/passwd
, but why not to/tmp/etc/passwd
? I've checked, and there are 2 differentetc
folders on the system; why is this the case?