COMP 3000 Lab 5 2011 - Revision history

Saran: /* Part B */

2011-11-21T16:59:37Z

Part B

← Older revision		Revision as of 16:59, 21 November 2011
Line 37:		Line 37:
	# 1.c		# 1.c
	# 2.c		# 2.c
	# An attacker could open foo, modify an [http://lxr.linux.no/linux+v3.1/include/linux/fs.h#L748 inode] to add set setuid and setgid bits and modify the owner and group of the file to 0,0 ( i.e root,root). She would then mount foo and run this file - which would run as root - to gain root privileges.		# An attacker could open foo, modify an [http://lxr.linux.no/linux+v3.1/include/linux/fs.h#L748 inode] to add set setuid and setgid bits and modify the owner and group of the file to 0,0 ( i.e root,root). She would then mount foo and run this file - which would run as root - to gain root privileges. Note that this method does not require you to assume that loopback mounting is permitted on non-writable directories.

	/* 1.c */		/* 1.c */

Saran: /* Part B */

2011-11-21T16:23:57Z

Part B

← Older revision		Revision as of 16:23, 21 November 2011
Line 20:		Line 20:
	==Part B==		==Part B==
	# [2] Create a simple C program to generate a file consisting of the word "Hello", one million bytes of blank space (null bytes), and then "world\n", but that consumes only a small number of blocks on disk while having a logical size of 1,000,011 bytes.		# [2] Create a simple C program to generate a file consisting of the word "Hello", one million bytes of blank space (null bytes), and then "world\n", but that consumes only a small number of blocks on disk while having a logical size of 1,000,011 bytes.

	# [2] Create a C program "mycopy.c" that takes two filenames A and B as command line arguments. This program should copy the contents of A to B, making B a byte-for-byte copy of A. Zero bytes in A should consume little to no space in B. (Hint: You'll have to use the sparse file creation technique of the previous question here.)		# [2] Create a C program "mycopy.c" that takes two filenames A and B as command line arguments. This program should copy the contents of A to B, making B a byte-for-byte copy of A. Zero bytes in A should consume little to no space in B. (Hint: You'll have to use the sparse file creation technique of the previous question here.)

	# [2] Describe a simple way an attacker could get root access on a system if loopback mounts were permitted for non-privileged users.		# [2] Describe a simple way an attacker could get root access on a system if loopback mounts were permitted for non-privileged users.

Saran: /* Part B */

2011-11-21T16:23:42Z

Part B

← Older revision		Revision as of 16:23, 21 November 2011
Line 19:		Line 19:

	==Part B==		==Part B==
	[2] # Create a simple C program to generate a file consisting of the word "Hello", one million bytes of blank space (null bytes), and then "world\n", but that consumes only a small number of blocks on disk while having a logical size of 1,000,011 bytes.		# [2] Create a simple C program to generate a file consisting of the word "Hello", one million bytes of blank space (null bytes), and then "world\n", but that consumes only a small number of blocks on disk while having a logical size of 1,000,011 bytes.

	[2] # Create a C program "mycopy.c" that takes two filenames A and B as command line arguments. This program should copy the contents of A to B, making B a byte-for-byte copy of A. Zero bytes in A should consume little to no space in B. (Hint: You'll have to use the sparse file creation technique of the previous question here.)		# [2] Create a C program "mycopy.c" that takes two filenames A and B as command line arguments. This program should copy the contents of A to B, making B a byte-for-byte copy of A. Zero bytes in A should consume little to no space in B. (Hint: You'll have to use the sparse file creation technique of the previous question here.)

	[2] # Describe a simple way an attacker could get root access on a system if loopback mounts were permitted for non-privileged users.		# [2] Describe a simple way an attacker could get root access on a system if loopback mounts were permitted for non-privileged users.

	=Answers=		=Answers=

Saran: /* Part B */

2011-11-21T16:23:21Z

Part B

← Older revision		Revision as of 16:23, 21 November 2011
Line 20:		Line 20:
	==Part B==		==Part B==
	[2] # Create a simple C program to generate a file consisting of the word "Hello", one million bytes of blank space (null bytes), and then "world\n", but that consumes only a small number of blocks on disk while having a logical size of 1,000,011 bytes.		[2] # Create a simple C program to generate a file consisting of the word "Hello", one million bytes of blank space (null bytes), and then "world\n", but that consumes only a small number of blocks on disk while having a logical size of 1,000,011 bytes.

	[2] # Create a C program "mycopy.c" that takes two filenames A and B as command line arguments. This program should copy the contents of A to B, making B a byte-for-byte copy of A. Zero bytes in A should consume little to no space in B. (Hint: You'll have to use the sparse file creation technique of the previous question here.)		[2] # Create a C program "mycopy.c" that takes two filenames A and B as command line arguments. This program should copy the contents of A to B, making B a byte-for-byte copy of A. Zero bytes in A should consume little to no space in B. (Hint: You'll have to use the sparse file creation technique of the previous question here.)

	[2] # Describe a simple way an attacker could get root access on a system if loopback mounts were permitted for non-privileged users.		[2] # Describe a simple way an attacker could get root access on a system if loopback mounts were permitted for non-privileged users.

Saran: /* Part B */

2011-11-21T16:23:06Z

Part B

← Older revision		Revision as of 16:23, 21 November 2011
Line 19:		Line 19:

	==Part B==		==Part B==
	# Create a simple C program to generate a file consisting of the word "Hello", one million bytes of blank space (null bytes), and then "world\n", but that consumes only a small number of blocks on disk while having a logical size of 1,000,011 bytes.		[2] # Create a simple C program to generate a file consisting of the word "Hello", one million bytes of blank space (null bytes), and then "world\n", but that consumes only a small number of blocks on disk while having a logical size of 1,000,011 bytes.
	# Create a C program "mycopy.c" that takes two filenames A and B as command line arguments. This program should copy the contents of A to B, making B a byte-for-byte copy of A. Zero bytes in A should consume little to no space in B. (Hint: You'll have to use the sparse file creation technique of the previous question here.)		[2] # Create a C program "mycopy.c" that takes two filenames A and B as command line arguments. This program should copy the contents of A to B, making B a byte-for-byte copy of A. Zero bytes in A should consume little to no space in B. (Hint: You'll have to use the sparse file creation technique of the previous question here.)
	# Describe a simple way an attacker could get root access on a system if loopback mounts were permitted for non-privileged users.		[2] # Describe a simple way an attacker could get root access on a system if loopback mounts were permitted for non-privileged users.

	=Answers=		=Answers=

Saran: /* Part A */

2011-11-21T16:20:59Z

Part A

← Older revision		Revision as of 16:20, 21 November 2011
Line 9:		Line 9:
	Be sure to do the following questions in order.		Be sure to do the following questions in order.

	# Run the command <tt>truncate -s 2G foo</tt>. What is the logical size of foo, and how much space does it consume on disk?		# [0.5] Run the command <tt>truncate -s 2G foo</tt>. What is the logical size of foo, and how much space does it consume on disk?
	# Run <tt>mkfs.ext4 foo</tt>. (Say "yes" to operating on a regular file.) What is the logical size of foo now, and how much space does it now consume on disk?		# [0.5] Run <tt>mkfs.ext4 foo</tt>. (Say "yes" to operating on a regular file.) What is the logical size of foo now, and how much space does it now consume on disk?
	# Run <tt>mount -o loop foo /mnt</tt>. What does this command do?		# [0.5] Run <tt>mount -o loop foo /mnt</tt>. What does this command do?
	# Run <tt>cp /bin/ls /mnt</tt>. What does this command do?		# [0.5] Run <tt>cp /bin/ls /mnt</tt>. What does this command do?
	# Run <tt>umount /mnt</tt>. Can you still access /mnt/ls? Why or why not?		# [0.5] Run <tt>umount /mnt</tt>. Can you still access /mnt/ls? Why or why not?
	# Run <tt>dd if=/dev/zero of=foo conv=notrunc count=10 bs=512</tt>. What does this command do?		# [0.5] Run <tt>dd if=/dev/zero of=foo conv=notrunc count=10 bs=512</tt>. What does this command do?
	# Run <tt>mount -o loop foo /mnt</tt> again. Why did the command fail?		# [0.5] Run <tt>mount -o loop foo /mnt</tt> again. Why did the command fail?
	# What command can you run to make foo mountable again?		# [0.5] What command can you run to make foo mountable again?

	==Part B==		==Part B==

Saran: /* Part A */

2011-11-07T21:31:20Z

Part A

← Older revision		Revision as of 21:31, 7 November 2011
Line 29:		Line 29:
	# It links foo to an unused loop device and mounts it in /mnt.		# It links foo to an unused loop device and mounts it in /mnt.
	# It copies the file located at /bin/ls to /mnt, indirectly writing it to foo.		# It copies the file located at /bin/ls to /mnt, indirectly writing it to foo.
			# After unmounting, files in that file system cannot be accessed, because /mnt is not linked to foo (where /bin/ls is actually stored as a file) anymore.
	# This command copies 10 blocks of 512 bytes each from /dev/zero to foo.		# This command copies 10 blocks of 512 bytes each from /dev/zero to foo.
	# Because writing 5120 bytes of zeros to the filesystem at foo corrupted it, destroying the superblock and invalidating some checksums.		# Because writing 5120 bytes of zeros to the filesystem at foo corrupted it, destroying the superblock and invalidating some checksums.

Saran: /* Part B */

2011-11-07T21:29:26Z

Part B

← Older revision		Revision as of 21:29, 7 November 2011
Line 68:		Line 68:
	int fdi,fdo,ret;		int fdi,fdo,ret;
	char buf;		char buf;
	if( (fdi = open("inputfile",O_RDONLY)) == -1)		if( (fdi = open("inputfile",O_RDONLY)) == -1)
	exit(1);		exit(1);
	if( (fdo = open("outputfile",O_RDWR \| O_CREAT \| O_TRUNC, S_IRUSR \| S_IWUSR \| S_IRGRP \| S_IROTH)) == -1)		if( (fdo = open("outputfile",O_RDWR \| O_CREAT \| O_TRUNC, S_IRUSR \| S_IWUSR \| S_IRGRP \| S_IROTH)) == -1)
Line 85:		Line 85:
	if(ret == -1)		if(ret == -1)
	printf("Error = %s\n",strerror(errno));		printf("Error = %s\n",strerror(errno));
	else if(ret == 0) //~~indicated~~ EOF		else if(ret == 0) //indicates EOF
	break;		break;
	}		}

Saran: /* Part B */

2011-11-07T21:28:55Z

Part B

← Older revision		Revision as of 21:28, 7 November 2011
Line 34:		Line 34:

	==Part B==		==Part B==
	#		# 1.c
			# 2.c
			# An attacker could open foo, modify an [http://lxr.linux.no/linux+v3.1/include/linux/fs.h#L748 inode] to add set setuid and setgid bits and modify the owner and group of the file to 0,0 ( i.e root,root). She would then mount foo and run this file - which would run as root - to gain root privileges.

			/* 1.c */
	#include <sys/types.h>		#include <sys/types.h>
	#include <sys/stat.h>		#include <sys/stat.h>
Line 52:		Line 55:
	}		}

	#		/* 2.c */

	#include <sys/types.h>		#include <sys/types.h>
	#include <sys/stat.h>		#include <sys/stat.h>
Line 90:		Line 92:
	return 0;		return 0;
	}		}

	# An attacker could open foo, modify an [http://lxr.linux.no/linux+v3.1/include/linux/fs.h#L748 inode] to add set setuid and setgid bits and modify the owner and group of the file to 0,0 ( i.e root,root). She would then mount foo and run this file - which would run as root - to gain root privileges.

Saran at 21:27, 7 November 2011

2011-11-07T21:27:48Z

← Older revision		Revision as of 21:27, 7 November 2011
Line 32:		Line 32:
	# Because writing 5120 bytes of zeros to the filesystem at foo corrupted it, destroying the superblock and invalidating some checksums.		# Because writing 5120 bytes of zeros to the filesystem at foo corrupted it, destroying the superblock and invalidating some checksums.
	# fsck.ext4 foo		# fsck.ext4 foo

			==Part B==
			#

			#include <sys/types.h>
			#include <sys/stat.h>
			#include <fcntl.h>
			#include <stdlib.h>
			int main()
			{
			int fd = open("helloemptyworld",O_RDWR \| O_CREAT \| O_TRUNC, S_IRUSR \| S_IWUSR \| S_IRGRP \| S_IROTH);
			if(fd == -1)
			exit(1);
			write(fd,"Hello",5);
			lseek(fd,1000000,SEEK_CUR);
			write(fd,"World\n",6);
			close(fd);
			return 0;
			}

			#

			#include <sys/types.h>
			#include <sys/stat.h>
			#include <fcntl.h>
			#include <stdio.h>
			#include <stdlib.h>
			#include <errno.h>
			#include <string.h>

			int main()
			{
			int fdi,fdo,ret;
			char buf;
			if( (fdi = open("inputfile",O_RDONLY)) == -1)
			exit(1);
			if( (fdo = open("outputfile",O_RDWR \| O_CREAT \| O_TRUNC, S_IRUSR \| S_IWUSR \| S_IRGRP \| S_IROTH)) == -1)
			exit(1);
			if(read(fdi,&buf,1) == -1)
			printf("Error = %s\n",strerror(errno));
			while(1)
			{
			if(buf == 0)
			lseek(fdo,1,SEEK_CUR);
			else {
			if(write(fdo,&buf,1) == -1)
			printf("Error = %s\n",strerror(errno));
			}
			ret = read(fdi,&buf,1);
			if(ret == -1)
			printf("Error = %s\n",strerror(errno));
			else if(ret == 0) //indicated EOF
			break;
			}
			close(fdi);
			close(fdo);
			return 0;
			}

			# An attacker could open foo, modify an [http://lxr.linux.no/linux+v3.1/include/linux/fs.h#L748 inode] to add set setuid and setgid bits and modify the owner and group of the file to 0,0 ( i.e root,root). She would then mount foo and run this file - which would run as root - to gain root privileges.