I want to highlight the SendEnv / AcceptEnv
answer and a different way to trigger it.
user1@host1 $ export LC_SECRET="pencil"
user1@host1 $ export LC_MAGIC="xyzzy"
user1@host1 $ ssh -o "SendEnv LC_*" user2@host2
user2@host2 $ echo $LC_SECRET
pencil
user2@host2 $ echo $LC_MAGIC
xyzzy
What's happening here is we're declaring environment variables called LC_SECRET
and LC_MAGIC
.
We've requested to send both LC_SECRET
and LC_MAGIC
to the remote host using SendEnv
.
The remote host will accept it because it has the following rule in /etc/ssh/sshd_config
:
AcceptEnv LANG LC_*
This is, obviously an exploit of the remote system that automatically accepts the LANG
environment variable or ANY environment variable starting with LC_
.
Hence, why I named my variables LC_SECRET
and LC_MAGIC
.
If you want to do it properly, the remote system will require sudo
access for you to modify /etc/ssh/sshd_config
to append other environment variables.