I was given a vulnerable 64bit dynamically linked stripped that runs simple checks to determine the strength of the passwords of users on a linux system.

The app checks if it the EUID is 0 and then creates two POSIX message queues one for the password hashes which it a child process reads using the shadow api and later sends to other worker child processes(#num defined by the user) that perform decryption attempts, and one where the workers send the weak passwords found to another child process that prints them on screen.

As stated in the instructions the app is supposed to be used by administrator users (i.e. root), which by my understanding means it is not a SUID, so no way of priviledge escalation (?).

My problem is that I don't know what to look for besides come kind of race condition or process failure scenario that can cause leakage of hashes or decrypted passwords. Is there anything that can be done by exploiting the Linker ?

  • Is there any chance that you could hijack a running POSIX message queue and read or inject messages in it ? I think that there is no security on accessing the queue between processes in the POSIX inter-processes communication schemes. But, I might be wrong! – perror Mar 15 '19 at 9:12
  • even if the queue belongs to root ? – Gian Mar 15 '19 at 9:40
  • I tried to dig a bit the thing and I found this section in the Secure Programs HOWTO and this question on another StackExchange website. Maybe you should look if all the permissions of the shared memories and files are properly done or if there is something wrongly done in it. – perror Mar 15 '19 at 10:08
  • the queues are opened with permissions set to 666=0x1b6 which means that there are public write/read permissions set, but when i run a process that runs mq = mq_open(QUEUE_NAME,O_RDWR, &attr); i get permission denied on errno. – Gian Mar 15 '19 at 12:01
  • I guess that the security flaw is here, then (666)! But, I guess your are still missing one little thing. As I never tried it before, I do not know precisely what is missing. Sorry. – perror Mar 15 '19 at 12:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.