0

We have an Ubuntu 18.04 user that connects via SSH and has a restricted shell. More precisely, their shell in /etc/passwd is /bin/bash, but a command= setting in authorized_keys restricts them to running a Python script. This script, among other things, writes some user-supplied data to a file. The file path can also be manipulated by the user. Suppose an attacker was able to exploit this to overwrite an arbitrary file (that the user has write access to). Could they leverage this to execute arbitrary code as that user, in effect getting an unrestricted shell?

The data the attacker controls is not at the beginning of the file, but wrapped in XML, like this:

<?xml version="1.0" encoding="utf-8"?>
<blah>
  <blah blah="ATTACKER_CONTROLLED_DATA" />
<blah>

I tried overwriting .bashrc with something like

<?xml version="1.0" encoding="utf-8"?>
<blah>
  <blah blah=""
echo exploit?
"" />
<blah>

but bash fails to parse this, so it does not execute.

The user cannot directly overwrite the authorized_keys files, as that's owned by root and it has read-only access. Same with the .ssh directory. It has write access to its home directory, but the script gives it no ability to move/delete directories.

Obviously this is theoretically exploitable, but I want to make the case that it can really happen.

0

If the data output file path can be manipulated by the user, and the data it writes is user supplied, that user can effectively write anything to any location they have write access to.

You have made an execution restriction via SSH which should prevent the user from executing code they may leave, which is a good start. If you are not careful, they could change a configuration file that would take effect when the service/server is restarted, or change a service script to perform extra actions when run by normal processes.

If you would not want them to set their .bashrc, why would you give them write access to that file? Make sure your permissions are set properly so a malicious user could not cause any problems through that script by overwriting anything, essentially only allowing them to write to the exact location you desire the data be written to.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.