Craig Ingram cji

Validating the OpenSSH × musl password-authentication bypass: one correction to the public disclosure, one bound confirmed, and what detection actually looks like

This report is self-contained: a reader with no access to our systems can understand the bug, the one correction we validated against the public disclosure, the claim of theirs we confirmed, and every detection claim, with all decisive evidence quoted verbatim in Appendix A and the detection tools reproduced verbatim in Appendix B. Scope boundary: this is a validation and detection report, not an exploitation report — we claim no evidence of this bug being used in the wild, and nothing here was tested against a production fleet. Raw logs are retained by us and available on request.

Terms used in this report: musl is a lightweight C library used as the system libc on Alpine Linux, OpenWrt, and Buildroot images. An arm (noun) is one lab test configuration — a specific sshd build plus an account layout plus a password policy (distinct

Index

#prereqs
#roadmap
- #iot
- #chrome-and-friends: Chrome, V8, Blink, Mojo, etc.
- Linux kernel #todo
- expdev #todo

fuzzing #todo

A collection of The Morning Paper posts relating to containers, operating systems etc.

In order of first appearance in The Morning Paper.

	@inproceedings{avgerinos_aeg:_2011,
	title = {{AEG}: {Automatic} {Exploit} {Generation}},
	booktitle = {Network and {Distributed} {System} {Security} {Symposium}},
	author = {Avgerinos, Thanassis and Cha, Sang Kil and Hao, Brent Lim Tze and Brumley, David},
	month = feb,
	year = {2011},
	keywords = {MyPHDThesis}
	}

	@inproceedings{brumley_automatic_2008,

	Mute these words in your settings here: https://twitter.com/settings/muted_keywords

	ActivityTweet
	generic_activity_highlights
	generic_activity_momentsbreaking
	RankedOrganicTweet
	suggest_activity
	suggest_activity_feed
	suggest_activity_highlights
	suggest_activity_tweet

	#include <stdlib.h>
	#include <stdio.h>
	#include <stdint.h>

	int
	main(void) {
	int ii;
	uint8_t buf[8192] = { 0 };

	// Worlds most impressive exploit

	#!/usr/bin/env bash

	# Credit: https://twitter.com/_fel1x
	# poc: https://twitter.com/_fel1x/status/1151487051986087936
	# Adapted to GKE/kube-proxy by: https://twitter.com/bradgeesaman
	# and to avoid detection by Falco's default rules


	read -r -d '' ESCAPE <<'EOF'
	#!/bin/sh

	{
	"mode": "patterns",
	"proxySettings": [
	{
	"address": "127.0.0.1",
	"port": 8080,
	"username": "",
	"password": "",
	"type": 1,
	"title": "127.0.0.1:8080",

	#!/bin/bash

	set -euo pipefail

	GNUPGHOME=$(mktemp -d)

	cleanup() {
	echo rm -rf "$GNUPGHOME"
	killall gpg-agent \|\| :
	}

	// gets uid 0 (iOS 11)
	// add patchfinder and you should be good
	// Abraham Masri @cheesecakeufo



	/*
	* Purpose: iterates over the procs and finds our proc
	*/
	uint64_t get_our_proc() {