We have an Ubuntu 18.04 user that connects via SSH and has a restricted shell. More precisely, their shell in /etc/passwd is /bin/bash, but a
command= setting in
authorized_keys restricts them to running a Python script. This script, among other things, writes some user-supplied data to a file. The file path can also be manipulated by the user. Suppose an attacker was able to exploit this to overwrite an arbitrary file (that the user has write access to). Could they leverage this to execute arbitrary code as that user, in effect getting an unrestricted shell?
The data the attacker controls is not at the beginning of the file, but wrapped in XML, like this:
<?xml version="1.0" encoding="utf-8"?> <blah> <blah blah="ATTACKER_CONTROLLED_DATA" /> <blah>
I tried overwriting
.bashrc with something like
<?xml version="1.0" encoding="utf-8"?> <blah> <blah blah="" echo exploit? "" /> <blah>
but bash fails to parse this, so it does not execute.
The user cannot directly overwrite the
authorized_keys files, as that's owned by root and it has read-only access. Same with the
.ssh directory. It has write access to its home directory, but the script gives it no ability to move/delete directories.
Obviously this is theoretically exploitable, but I want to make the case that it can really happen.