File tree Expand file tree Collapse file tree
src/linux-hardening/privilege-escalation Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -440,16 +440,6 @@ Bash performs parameter expansion and command substitution before arithmetic eva
440440 # When the root cron parser evaluates (( total += count )), your command runs as root.
441441 ```
442442
443- - Preconditions:
444- - You can cause a line you control to be written into the log consumed by the root script.
445- - The script evaluates an untrusted variable inside ((...)), $((...)) or let.
446-
447- - Mitigations (for defenders):
448- - Never use arithmetic evaluation on untrusted strings. Validate first: ` [[ $count =~ ^[0-9]+$ ]] || continue ` .
449- - Prefer integer-safe parsing with awk or mapfile and explicit regex checks.
450- - Run log parsers as least-privileged users; never as root unless strictly necessary.
451-
452-
453443### Cron script overwriting and symlink
454444
455445If you ** can modify a cron script** executed by root, you can get a shell very easily:
You can’t perform that action at this time.
0 commit comments