IWETHEY v. 0.3.0 | TODO
1,095 registered users | 0 active users | 1 LpH | Statistics
Login | Create New User
IWETHEY Banner

Welcome to IWETHEY!

IWETHEY Home / IWETHEY Board / Linux Forum / I'll bite
Post #17,538
by cforde
Picture of cforde
11/9/01 2:57:35 PM
Reply
New I'll bite
the touch command is used to set the timestamp on a file. You can touch a non-existent file and touch will create it for you. The bad hat doesn't have read access to the password file, so he can't look at it or copy it. But maybe by faking out touch with the bogus path he can have it copy the password file to /tmp/wicked where he will be able to read it.

Have fun,
Carl Forde
Post #17,541
by wharris2
11/9/01 3:04:53 PM
Reply
New That sounds wrong
If a system isn't running shadowed passwords, he'd have read access to /etc/passwd already. (Unless someone has taken the time to chmod 400 /etc/passwd, which... hmmm... I don't know what would break. Time for experimentation (system security for the paranoid. :=))

If it's using shadow passwords, he doesn't have access to it anyway.

On HPUX 11.0, with ksh, it doesn't do anything.
"Beware of bugs in the above code; I have only proved it correct, not tried it."
-- Donald Knuth
     Linux Test - (broomberg) - (21) - Nov. 8, 2001, 11:02:17 PM EST
         Don't hire me. - (Another Scott) - Nov. 9, 2001, 11:27:04 AM EST
         Re: Linux Test - (JayMehaffey) - Nov. 9, 2001, 12:04:45 PM EST
         See the comments at LinuxToday - (ben_tilly) - (12) - Nov. 9, 2001, 01:42:45 PM EST
             I'll bite - (broomberg) - (9) - Nov. 9, 2001, 02:39:48 PM EST
                 So far so good, now for a hint - (ben_tilly) - (8) - Nov. 9, 2001, 03:06:03 PM EST
                     My guess - (Steven A S) - (1) - Nov. 9, 2001, 03:58:13 PM EST
                         Bingo - (ben_tilly) - Nov. 9, 2001, 04:43:17 PM EST
                     gak - (cforde) - (5) - Nov. 10, 2001, 01:05:58 AM EST
                         null and / - (ben_tilly) - (4) - Nov. 10, 2001, 02:15:31 PM EST
                             dont forget pipe and redir | > and your example would be ok - (boxley) - (1) - Nov. 10, 2001, 10:44:44 PM EST
                                 touch 'foo | bar > baz' - (ben_tilly) - Nov. 12, 2001, 04:59:39 AM EST
                             Berkeley, Unix and something else - (cforde) - (1) - Nov. 12, 2001, 01:12:27 AM EST
                                 It is easier to allow than to disallow - (ben_tilly) - Nov. 12, 2001, 05:02:10 AM EST
             I'll bite - (cforde) - (1) - Nov. 9, 2001, 02:57:35 PM EST
                 That sounds wrong - (wharris2) - Nov. 9, 2001, 03:04:53 PM EST
         Unix Review -- can't connect - (kmself) - (1) - Nov. 9, 2001, 05:26:35 PM EST
             Works here - DC area, Nav4/Win32. -NT - (Another Scott) - Nov. 9, 2001, 05:33:50 PM EST
         Heh. - (static) - Nov. 11, 2001, 06:51:46 AM EST
         I thought I didn't know much about Linux... - (Meerkat) - Nov. 11, 2001, 08:19:52 PM EST
         Re: Linux Test - (gdaustin) - Nov. 13, 2001, 02:25:28 PM EST
         Late comer... - (folkert) - Dec. 13, 2001, 11:57:04 PM EST

A....E....I....O....U....Some....Times....Y.
138 ms