PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Readline crime: exploiting a SUID logic bug

blog.trailofbits.com | blog | #linux | #privilege-escalation | #exploit | #lateral-movement | #vulnerability-analysis | #suid | #readline | #logic-bug | #environment-variable | #chfn
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A logic bug in readline leaks partial file contents when parsing the INPUTRC environment variable, exploitable via SUID binaries like chfn for lateral movement; reported and patched in February 2022.
Published
Collected

Related coverage

High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
blog · netspi.com
Stealing unencrypted SSH-agent keys from memory
SSH-agent holds decrypted keys in memory to spare users passphrases, but root attackers can dump that memory with gdb via ptrace and reconstruct private keys, for fast pivoting to other machines.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
tool · github.com
Linux LPE Toolkit: Multi-Architecture Automated Privilege Escalation Tool
Provides penetration testers and red teams with an all-in-one, multi-architecture automated post-exploitation toolkit that simplifies Linux kernel privilege escalation without requiring on-target compilers.
research · starlabs.sg
Old Wine in a New Bottle: A Decade-Old lxd-Group Root, Re-Armed
Ubuntu Server silently puts the first user in the lxd group, root-equivalent by design. The seeded lxd-installer socket lets lxd users install LXD password-free and reach host root; vendor won't fix.
blog · yeswehack.com
Introduction to postMessage() Vulnerabilities
An introduction to postMessage() vulnerabilities: how cross-origin messaging works, the XSS and data-exposure risks when misconfigured, and how to find and exploit vulnerable message listeners.
Back