Skip to content

Latest commit

 

History

History
9 lines (8 loc) · 627 Bytes

logrotate.md

File metadata and controls

9 lines (8 loc) · 627 Bytes

↻ logrotate

  • config: /etc/logrotate.conf
    • To exploit we need following:
      • we need write permissions on the log file
      • logrotate must run as a privileged user or root
      • vulnerable versions: 3.8.6, 3.11.0, 3.15.0, 3.18.0
    • Check cat /var/lib/logrotate.status to force rotate use -f
    • Use this exploit with payload as and check which option is used in logrotate.conf with grep "create\|compress" /etc/logrotate.conf | grep -v "#" and run with ./logrotten -p ./payload /tmp/tmp.log where tmp.log is a writable log file