Security problem? Getting root is ridiculously easy.

Well, then I noticed the other day that an app (can't remember which) that usually of guests for my password to get root privileges didn't do - it just keeps going do need privileges for.

I remembered that shortly before, I used sudo in iTerm to run a command with root privileges, and I know that OS X is not asking your password the first time you run sudo unless a certain number of minutes has elapsed. I had assumed that this behavior would be local to the thread which you initially provided the password, what would have been the zsh session in iTerm. However, it seemed that he was local, at the session of zsh, zsh, or the iTerm. A completely different application had apparently grafted on my sudo 'session' and acquired the rights root without my permission.

I tested this by issuing a sudo command in zsh in iTerm, and then, after giving my password, I opened Terminal with bash and issued a command sudo there. No guest password, root privileges instant.

On this basis, it is clear that any application that is running as a user who can run sudo to obtain root privileges (which is any normal OS X user) can wait for the user to run sudo and immediately obtain root access on the system. Know when the current user runs sudo is easy, such an event is written to the syslog.

Proof of concept. Quick-n-dirty. Save as a script and run in a terminal window. Then run sudo in another Terminal window. The script will intercept the sudo event and write the empty file "kilroy was here", as root: wheel, at the root of the drive.

#! / bin/bash

tail-f n 0 /var/log/system.log | grep m 1 EI ' sudo\ [[0-9] +------]: \s+'$USER

echo «go play with root privs...» »

sudo touch/kilroy-was-here

This seems... Bad... Thoughts?

Daniel

Can you show a gain (Standard) of the 'Normal' user root after the administrator has used sudo?

Tags: Mac OS & System Software

Similar Questions

  • OfficeJet Pro 8610: Get the Permission of HPeprint or security problem error

    I used printing wireless for several months successfully to print from my work computer, but am now able to print to the e-mail address provided.

    The error reads 'your message was not delivered because of a permission or a security problem.  It may have been rejected by a moderatory, the address can only accept email from certain senders, or another restriction to prevent any delivery.

    The Organization rejected your message: hpeprint.com. »

    I've reconfigured my printer to my router.  Any suggestions?

    Hey @LoreeW,

    Welcome to the Forum from HP Support. I hope you enjoy your experience here.

    I understand that you have a few problems with ePrint using your HP Officejet Pro 8610 e-all-in-one printer.  I want to help you with this.

    I recommend that you first check your printer to verify its intact ePrint connection:

    • Touch the icon (webservices)
    • If you see an address @hpeprint.com, I recommend that you try to send a test ePrint from a different email domain than what you use on your work computer.  If it prints correctly, we can rule out your printer as being a factor in this particular issue.  If your printer's Web services is enabled is more, re - enable.  Any problem would occur with this, click here to access another relevant post I created.  Scroll to my suggestion re: setting a manual DNS as this tends to help by allowing the webservices where fail the normal steps.

    If you were able to send your printer work ePrint of any e-mail domain other than the one you use at work, read on.  Click here to see an HP ePrint article that focuses on the various factors that can contribute jobs ePrint not printing not.  Note that some areas of corporate email may become incompatible with ePrint due to the presence of a digital signature in the outgoing message template.  EPrint jobs you send work meet these criteria?

    Please let me know the result of your troubleshooting by responding to this post.  Thanks again for reaching out in the Forums - we are always happy to help you.  If I helped you to solve the problem and that you liked this post, feel free to give me virtual accessories by clicking on the 'Thumbs Up' icon below.

    Have a great day!

  • I received this warning when I open a specific page on my Web site in Internet Explorer: MuseJSAssert: error calling the function switch: error: a security problem has occurred.

    Hello

    I discovered when I'm in Internet Explorer and go to the page "artists."

    and I click on a name, for example: "Abel team ELA / I ai Gomes

    I get this warning:

    MuseJSAssert: Error calling the function switch: error: a security problem has occurred.

    It is only in IE, not when I use Safari or Chrome

    This is the Web site link

    Any ideas how to solve this problem?

    There is an invalid hyperlink on the Abel Equipe ELA / I've got Gomes page on a piece of text which reads "with"your entry. You must find this text in the Muse, delete the hyperlink and enter a valid.

  • Having a problem getting 2 video cards to work

    Windows is having a problem getting 2 video cards to work in a desktop HP dc5800 SFF computer.  The first video card is a nVIDIA GeForce MX 4000 Jaton and the second video card is a VisionTek X 1300.  The two cards are dual monitor.  We strive to give the user 3 screens, but this configuration should be able to output of 4 monitors, if none of the material is in conflict with each other.  The integrated graphical subsystem integrated into the motherboard is disabled whenever a new video card is installed, due to the design of the Intel video chipset.  Any ideas what to try?

    Hi Myextraidentity,

    You cannot combine NVIDIA and ATI graphics cards. This configuration is not possible

    You can consult with NVIDIA or ATI to learn more about what is needed to support 3 + monitors

    NVIDIA:

    http://www.nvidia.com/page/contact_information.html

    ATI:

    http://www.AMD.com/us/aboutamd/contact-us/pages/contact-us.aspx

    Kind regards

    Kiki

  • Security problem with hidden extensions checked.

    I said I should uncheck "Hide extensions of the file types that you want to know" in Windows 7, because I could inadvertently download a document with a double extension like 'Memo.txt.vbs. If the extension is hidden, then it would appear like 'Memo.txt. It would be a security problem. Is this true?

    For any question on Windows 7:

    http://social.answers.Microsoft.com/forums/en-us/category/Windows7

    Link above is Windows 7 Forum for questions on Windows 7.

    Windows 7 questions should be directed to / stationed there.

    You are in the Vista Forums.

    See you soon.

    Mick Murphy - Microsoft partner

  • Best calls "Windows Help" Attorney call me to say I have a security problem on my PC and wants that I let him remote connect to solve this problem, it is legitimate?

    The first few times we call I refused to listen to because it sounded wrong, but this time I heard him out and that's what they said. First, he was of the India, I think his accent and he said he was calling to inform me about a security problem with my PC, it is said to "Best Windows Help" and that my network was showing at its end with a red light indicating a problem. He had opened the Run command and type of command bar to display the observer of events and go to the newspapers of Win and click Applications, then he wanted me to scroll the Application events and see how many errors was there. Between 20 and 50 I said, he said oh yes you have a problem and that he could fix in a few minutes, then it puts me in a collaborator of his that says display the control bar run then type "Iexplore www.support.me" which led me to a "Logmein Rescue page to https://secure.logmeinrescue.com/Customer/Code.aspx. At this point, that he asked me to give him full access to my PC in which I said, "you're crazy, no way" and he said OK then your PC will freeze and crash and I said a few words very friendly back and hung up. They seem to call every month or two and it looks like the same guy. Is it a Con? Who is this company "best Windows Help and how are they finding me? They say the information they hold comes from Microsoft. My caller ID lists like V052409070106, phone # (202) 011 - 3341. What is everything. Also, my PC is not crash or freeze because I installed it 2 years ago. I am running Win 7 Pro with Microsoft Security Essentials and windows Firewall behind a Cisco router.

    Scam.  They said that my computer was downloading malicious code and therefore transmit signals the error on their server.

    They have a Web site, as afar as I can tell.  I asked the guy at the phone for his site.  He couldn't give me a Web site URL or couldn't pronounce correctly.  He was frustrated and hung up.  Scam.

  • Security problems.  Adobe connects vires of intellectual property. and if so recognize who visited my recordings.  Thank you

    Security problems.  Adobe connects vires of intellectual property. and if so recognize who visited my recordings.  Thank you

    Connect does not collect IP addresses. Records can follow who saw them if viewers are journaled in Connect.

  • File restrictions not met does not, major security problem with Reader shared.

    Summary: it is possible to transfer files freely between host and virtual machines, but are not limited to declared Shared Folders.

    I'm under VMWare Player 6.0.3 + tools under Win7/32, generally without problems. However, I just found out what seems to be a major security problem; It may have been there for years, I never checked. On a CentOS Linux VM and a Windows XP VM, I put folders always active; two folders are shared, C:\Users\ < name > \Desktop\VMWare (a subdirectory on the desktop) and R:\ (a RAM drive). "Card as a drive in Windows network, you can" is checked in the virtual Windows machine. There is no option for a folder always be not shared, the other only until the next poweroff (re point 2 below). I did some tests and was able to easily drag and drop files from the two virtual machines (running at once) to the host WITHOUT RESTRICTION FOR THE SHARED FOLDERS; I copied the files of the computer desktop virtual on the desktop of the host (not the directory said 'VMWare'), the office of the host on the desktop of the virtual computer and directory host random (C:\TMP) on the virtual machine, and then again to the desktop of the host.

    1. serious, important question: the VM seems to have free run of the host, not only in the shared directories.

    2. point minor: indicates the VMX (all below dossier_partage) file < sharedFolder0.expiration = "session" > but < sharedFolder1.expiration = "never" >; should not be the same thing, 'never' as records of actions are always enabled?

    I have shared folders only through settings, no direct VMX edition. The VMX has:

    sharedFolder.maxNum = '2 '.

    sharedFolder0.present = 'TRUE '.

    sharedFolder0.enabled = 'TRUE '.

    sharedFolder0.readAccess = 'TRUE '.

    sharedFolder0.writeAccess = 'TRUE '.

    sharedFolder0.hostPath = "C:\Users\ < name > \Desktop\VMWare.

    sharedFolder0.guestName = ' transfer to '.

    sharedFolder0.expiration = "session".

    sharedFolder1.present = 'TRUE '.

    sharedFolder1.enabled = 'TRUE '.

    sharedFolder1.readAccess = 'TRUE '.

    sharedFolder1.writeAccess = 'TRUE '.

    sharedFolder1.hostPath = "R:\". »

    sharedFolder1.guestName = "RamDrive.

    sharedFolder1.expiration = "never".

    That concerns me; I sometimes deliberately tried to expose virtual machines to viruses, in the hope that there is a Chinese wall between the host and the VM, except for shared directories.

    I am dong something wrong, is this expected behavior or is it an error in VMWare Player?

    Best wishes

    Looks like you're confused shared with drag-and-drop folders.  With shared folders, the host files are mapped in the comments (possibly as a Windows network drive).  Navigate in the comments under \\vmware-host.  Drag-and-drop is a completely independent feature.  There is no restriction on access to the drag-and-drop.  To disable drag-and - drop in VMware Player, power off the virtual computer and add the following to your virtual machine configuration file:

    insulation. Tools.Copy.Disable = 'TRUE '.

    insulation. Tools.dnd.Disable = 'TRUE '.

    insulation. Tools.Paste.Disable = 'TRUE '.

  • Security problem - version XI

    If (!.) IsDocOpened (docConst.HelpFile))
    {
    Try
    {
    oDoc = openDataObject (docConst.HelpFile);
    var szFilePath = oDoc.path;

    } catch (e)
    {
    ShowError (e.message + "\c path was \'" + szFilePath + "\" ", 0");
    }

    try {}
    oDoc = app.openDoc ({cPath: szFilePath})

    ({acachees: false}); Security this access problem

    } catch (e) {}

    App.Alert (' error in app.openDoc: "+ e.message);
    }

    }

    I am gettting a security problem when you try to open an attachment. What I forget?

    Perhaps, this must be a function of trust at the level of the folders?

    As a professional, there is an option for document level scripts. With the standard, you must use the JavaScript console to add the script.

    Did you look at example 2 for disclosed? It can be run from the JS console.

  • security problem - country dimension

    Hello...
    I really don't understand how to plan security works.
    I realize that I have to give access to certain dimensions in order to make the forms available.

    question #1. What dimensions? all standards?

    question #2. I want to make available superior country dimension member... I can assign access to all his descendants, but not for members of the root.
    I tried to remove access for all, but forms are not available.

    Thank you
    Daniele

    dperego wrote:
    Hello...
    I really don't understand how to plan security works.
    I realize that I have to give access to certain dimensions in order to make the forms available.

    question #1. What dimensions? all standards?

    question #2. I want to make available superior country dimension member... I can assign access to all his descendants, but not for members of the root.
    I tried to remove access for all, but forms are not available.

    Thank you
    Daniele

    Hello

    Q1 - accounts, entity, scenario and Version, you will need to apply security, you can also add it to dimensions custom if it's your choice.

    It is not really to forms of work, it must be able to view the members of a dimension on the form.

    Q2 - you can not apply it to the root and it must be done at a lower level, if possible just create an additional as a child of the root member and put everything under it, and then apply security as the descendants of the Member then users would not see.
    There was a way to apply security to the root in the 9.3.x but this trick has been removed in 11, so I do not recommend it.

    See you soon

    John
    http://John-Goodwin.blogspot.com/

  • After the installation of 41.0.1 gmail site has security problem, also cannot get roboform toolbar to display after activation of Roboform in FF

    FF broke so I upgraded to 41.0.1. After that whenever I tried to go to gmail.com , I get a message of no reliable view security. Tried to ignore the message, but received another similar message and was hardly the easy just configure an exception for each of them.

    Also activated roboform version newly installed but cannot get the roboform toolbar to display.

    I'm 10 Windows and the version of ff is 41.0.1

    Hi Andy, which display the certificate refer to the "issuer", certificate Firefox does not trust. He mentioned Microsoft parental control? Unfortunately, everything I know about this certificate was already in my previous answer.

  • Get a pop up message saying that I have a Firefox security problem

    I started to receive messages pop up saying that my Firefox browser has a problem of serious security and for me to give a phone number.
    !. It is a real message of Mozilla, or is it a phishing message?
    2 should Whtat action I take in the future?

    1. no that is not true. Mozilla has never communicates by telephone.
    Sounds like malware on your PC.
    2. ignore in the future.

    Sometimes a problem with Firefox can be a result of malware installed on your computer, you may not be aware of.

    You can try these free programs to search for malicious software that work with your existing anti-virus software:

    Microsoft Security Essentials is a good permanent antivirus for Windows 7/Vista/XP, if you do not already have one.

    More information can be found in the article troubleshooting Firefox problems caused by malware .

    This solve your problems? Please report to us!

  • Security problem - Everytime I sign in my e-mail, I get an error message saying that my account has been blocked temporarily.

    Whenever I'll sign in my e-mail, I get an error message saying that my account has been blocked temporarily. I changed my password, and I always get the same messages. I can't send email because it asks me to verify my account. When I do, I always get the same message. What can I do else? Help!

    Hi Tom,

    Are you referring to Windows Live Mail? If so, I would say that to visit the Windows Live Solution Center that is not a problem we can help solve the answers:
  • Startup problem, get an error missing: &#60; ROOT WINDOWS &#62; \system\ntoskrnl.exe

    OP: Start-up of the question

    I starts instead of windows displays an error coming. It says I'm missing: \system\ntoskrnl.exe. How can I fix it?

    Hello Gwafer74,

    This problem can be caused if the Ntoskrnl.exe file is missing or damaged. You can follow the steps described in the article for this problem:

    http://support.Microsoft.com/kb/314477

    Follow the steps in method 1.

    Thank you
    Irfan H, Engineer Support Microsoft Answers. Visit ourMicrosoft answers feedback Forum and let us know what you think.

  • security problem cannot get rid help ms10-024

    keeps poping up is it haszourdous? to my pc? I try to go to microsoft, but tells me that I can't do nothing

    Hi wampie,

    Take a look at the following thread:

    http://answers.Microsoft.com/en-us/Windows/Forum/windows_other-windows_update/XP-cant-install-update-kb981832/501bbe47-41A3-4D3E-8EDE-de5a526785ba

Maybe you are looking for