From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-0.8 required=5.0 tests=DKIM_ADSP_CUSTOM_MED, DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FROM,HTML_MESSAGE,MAILING_LIST_MULTI, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 Received: (qmail 15138 invoked from network); 2 Aug 2023 03:43:18 -0000 Received: from minnie.tuhs.org (2600:3c01:e000:146::1) by inbox.vuxu.org with ESMTPUTF8; 2 Aug 2023 03:43:18 -0000 Received: from minnie.tuhs.org (localhost [IPv6:::1]) by minnie.tuhs.org (Postfix) with ESMTP id CDFF7410DC; Wed, 2 Aug 2023 13:43:13 +1000 (AEST) Received: from mail-oa1-x30.google.com (mail-oa1-x30.google.com [IPv6:2001:4860:4864:20::30]) by minnie.tuhs.org (Postfix) with ESMTPS id 66548410C7 for ; Wed, 2 Aug 2023 13:43:03 +1000 (AEST) Received: by mail-oa1-x30.google.com with SMTP id 586e51a60fabf-1bb7d1f7aeaso5069433fac.1 for ; Tue, 01 Aug 2023 20:43:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1690947782; x=1691552582; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=0vHLUGMwEbJTHFu9tGcsa2zS26bHp4UwksGokjdNEik=; b=QJ/VdMFrtkkqYOrbmMvPBzbpgR4DPkHoLMofHvmdhc04LG2sOay20FEkWVr9SirZmx GXx1T7/IdgaY+kdek54xUHfDBXT3vilkEvH+pPROr76DPiCjcOWAovnB652XG6VyvI3n lr8V4oRCV9n5Nzucbn+iwN54AGCb1+yc/D++ZPWgPmIdjtKRkw4UigFz/NpLyDIlGKom jwYXLpUSTDD0AgXXVC35xbK+IJZ4cya9UFslkVgHMgZhBMXsP7OzRcbD37djDhGNZvKE 9/E9od1sJYV0y5nYukdFUja26w2a2gEGy62J79sy+KxomdVsNx1xJ5PWu2QBs9JsGQHj NoiQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1690947782; x=1691552582; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=0vHLUGMwEbJTHFu9tGcsa2zS26bHp4UwksGokjdNEik=; b=dyVwtRGnFrwvFaNk05Xi8yBIb4LQrkzAVZfz7NgPRTV4T+9+yPcqJiD42ZQJgt0Ry5 GaI/oDfvKec4r9xBam9zQGD0xqhwxxRnXSj3cvBpmh4gAkaNAvoYd8pFEV+ywCcksTS6 KEJkiITDNvZyJMvmM16NKndJh7sr2i+8JS1m6SEbllgjFYscraViB7eJsYeXdC9kiH5d aTMqlNusGmq4EVVAsc1j7W27nOuiEgljy+lbC/YPjdlqmc9kMYx3jgJMmd1O0KXIbX/r zcaSyAWFsiHpictkYaULHCA19SxY7+rEg2Bsxyew6SmC85vcduHIp2igTTvNOFlHzFlE QpLg== X-Gm-Message-State: ABy/qLacJZ2opCnGLMvW2VjUFBJwqiZS0qgXeG2XJb0zZlnhvHUPIz9x Op3CddWIXO2NUybhsQtGKpnbVI95VJheUxDz4h7GYJef X-Google-Smtp-Source: APBJJlGrIwtyvgSUWZ7IvWU4Zktfc6VrA0N0aYok8Eqmg434qgnxX/krUmrVK+m/U3NjshiZqDMjK6IVgQX0bLfIpBI= X-Received: by 2002:a05:6871:588:b0:1be:dfdf:cb1 with SMTP id u8-20020a056871058800b001bedfdf0cb1mr9318553oan.46.1690947782396; Tue, 01 Aug 2023 20:43:02 -0700 (PDT) MIME-Version: 1.0 References: <3132b52a-d490-4a8e-1c53-9f504209a54f@tnetconsulting.net> In-Reply-To: <3132b52a-d490-4a8e-1c53-9f504209a54f@tnetconsulting.net> From: Niklas Karlsson Date: Wed, 2 Aug 2023 05:42:49 +0200 Message-ID: To: Grant Taylor Content-Type: multipart/alternative; boundary="000000000000e74edd0601e875d2" Message-ID-Hash: KUZ5BKARMQ6CGV4QRPPEKF3JBXLITPIK X-Message-ID-Hash: KUZ5BKARMQ6CGV4QRPPEKF3JBXLITPIK X-MailFrom: diamondwings@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tuhs@tuhs.org X-Mailman-Version: 3.3.6b1 Precedence: list Subject: [TUHS] Re: shell escapes in utilities List-Id: The Unix Heritage Society mailing list Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --000000000000e74edd0601e875d2 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Den ons 2 aug. 2023 kl 05:01 skrev Grant Taylor via TUHS : > On 8/1/23 1:55=E2=80=AFPM, Niklas Karlsson wrote: > > What you did with that RS/6000 sounds roughly equivalent to booting > > a modern Linux box in single-user mode, where you can also set the > > root password to anything you like. > > I think that's *HIGHLY* dependent on the distribution. Some systems > make it harder than others to get into single user mode. I feel like > "sulogin" comes into play here. > > The thing that I used to do is append "init=3D/bin/sh" to the GRUB boot > line via the transient editor. Drops you at a shell and bypasses almost > all of the startup scripts. Obviously there are ways to secure against > this. But, again, it depends on the distro. > Sure. Like I said, there are ways and means to avoid this. Not going to argue against that. Niklas --000000000000e74edd0601e875d2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Den ons 2 aug. 2023 kl 05:01 skrev Grant Taylor via TUHS <tuhs@tuhs.org>:
On 8/1/23 1:55=E2=80=AFPM, Niklas Karl= sson wrote:
> What you did with that RS/6000 sounds roughly equivalent to booting > a modern Linux box in single-user mode, where you can also set the > root password to anything you like.

I think that's *HIGHLY* dependent on the distribution.=C2=A0 Some syste= ms
make it harder than others to get into single user mode.=C2=A0 I feel like =
"sulogin" comes into play here.

The thing that I used to do is append "init=3D/bin/sh" to the GRU= B boot
line via the transient editor.=C2=A0 Drops you at a shell and bypasses almo= st
all of the startup scripts.=C2=A0 Obviously there are ways to secure agains= t
this.=C2=A0 But, again, it depends on the distro.

=
Sure. Like I said, there are ways and means to avoid this. Not g= oing to argue against that.

Niklas
--000000000000e74edd0601e875d2--