This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig614040150BFC1D8CB9FA4CC5
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

If we have access to another user ~/ why installing root kit and not use
some trivial attack ? like path attack as example or clean exec ?
installing a root kit on monitored system will yell alarms. as i
previously said if we have access to another user ~/ we have full access
to all privileges that this user have.
the main issue here is how we get access to the user ~/

about the local virus ..
in the example given by the author we compromise the user A which have
sudo to root
if we have knowledge of the target system we can easily make automated
program that compromises other users accounts but .. /there is always
but/ in order to compromise other users we will need bigger privs than
the user that we attack or some system wide exploit /which is sort of
bigger privs/. then if we have those privs why bothering writing a
automated program and not compromise them at once ?

the only scenario that this is useful is if we have a user A which can
execute commands in the context of a user B which can execute commands
in context of root
in that case if we have a way to compromise user A's ~/ then we can make
some automated program that gathers information ,even have some
predefined logic about handling some commands enabled in /etc/sudoers,
and then exploit it. but thats a very rare case.

p.s.
sudo to root without pass ... c'mon you have to be kidding me, right ?

Javor Ninov aka DrFrancky
drfrancky[shift + 2]securax.org
securitydot.net


Steven M. Christey wrote:
>> So, in other words, all you need in order to get root access is a
>> rootkit, your shell script, and root access? Ummm... I don't get it.
>=20
> I was also confused by this. However, one guess is that by
> compromising an unprivileged account and creating command aliases to
> run trojaned su and sudo programs, the attacker can hopefully gain
> access to another account, then another, etc. By using these sudo
> "privilege chains" the attacker might eventually obtain root access.
>=20
> This attack would be slightly virus-like in behavior, although local
> to the system. And it might accomplish less, and more slowly, than if
> the attacker used some other means to determine the explicit su/sudo
> relationships and exploit them directly (e.g. sudo -l to list allowed
> commands?) And this attack sounds like it's entirely dependent on
> whether or not such a chain even exists on the system. Insert
> standard text about the likelihood of easier attack vectors here.
>=20
> Just a guess, though. Interesting notion of a local-only "virus" to
> compromise users on a multi-user system, although it seems like just
> another way to exploit trust relationships once you've gained access
> to a local account.
>=20
> - Steve


--------------enig614040150BFC1D8CB9FA4CC5
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (MingW32)

iD8DBQFEKltack4kcwaj+YIRArZ8AJ41ffdZyeCO8QNtaZSHxe enZoTaPQCfRq5S
t7jKiG9XzeHn1C5JlunBS8o=
=O70L
-----END PGP SIGNATURE-----

--------------enig614040150BFC1D8CB9FA4CC5--