Bug is sudo?

From: Rhodie (rhodieat_private)
Date: Thu Jun 25 1998 - 17:25:56 PDT

  • Next message: Andrew Clegg: "Re: guestbook script is still vulnerable under apache"

    I was messing arround with sudo when i found out that you can check to see
    if there is a file that can be exec'd by root, even if you don't have the
    privlages. IE: You can check to see if there is a program, in the root
    path, that you can't see (maybe can and its just easyer to do it this
    way).
    The normal way to use sudo is 'sudo command' and it asks you for your
    password, you put it in and it exec's as root, you get it wrong and it
    doesnt.... Try sudo <command that doesnt exist>, it says:
    sudo.bin: fdsa: command not found
    So? you say, well, you can check to see if there is something to play with
    that root has hidden....
    
    Take a look at these:
    
    (rhodie@is-so) [~]$ sudo fdsa
    sudo.bin: fdsa: command not found
    (rhodie@is-so) [~]$ sudo id
    Password:
    
    Heh, isn't that purty?
    
    -------------------------------
    Get your own rhoide too! Coming soon to stores!
    ---===***)))The other barefoot wanna-be-programer(((***===---
    Find me on almost any major network (exept for efnet, because they suck)
    and visit technonet! Dark.TechnoNet.Net 6667
    --------------------------------------------------------------------------
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 13:59:49 PDT