[TUHS] Re: shell escapes in utilities

[Niklas Karlsson <nikke.karlsson@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1257 bytes --]

Den tis 1 aug. 2023 kl 20:43 skrev Ron Natalie <ron@ronnatalie.com>:

>
> I remember IBM sending me an early RS/6000.    Booted the
> thing up but had no clue what root or any other password was.
> So, I set to work hacking on it.   Now this thing had a physical key on
> the front.   Off, On, and a Wrench symbol.   OK, let’s try the wrench.
>   Boots up some sort of maintenance program.   After playing around with
> it a bit I find a help option.    This starts up a paginator (more or pg
> or something).    Sure enough you can shell escape otu of that.
> Instant root shell.    Now it’s trivial to change the root password and
> reboot in normal mode.
>

To be fair, local root exploits are a bit of a different animal from
remote ones. Even now, if you have physical access to your average *nix
box, you can likely gain root. Sure, there are ways and means of
preventing that, but IME it's really only people doing really secret
spook stuff that bother with those. Even engineering outfits with big
secrets to protect usually don't bother.

What you did with that RS/6000 sounds roughly equivalent to booting a
modern Linux box in single-user mode, where you can also set the root
password to anything you like.

Niklas

[-- Attachment #2: Type: text/html, Size: 1651 bytes --]