earthquake/chw00t

chw00t - Unices chroot breaking tool

chw00t's Issues

Question on SFTP Without Execution

What would the attack profile with chw00t be on a system like this?

override default of no subsystems

Subsystem sftp /usr/lib/openssh/sftp-server

Match User companyname
ForceCommand internal-sftp
ChrootDirectory /opt/sftp/companyname
PermitTunnel no

Where /root is not world writeable? drwx------ 4 root root 4096 Jul 15 21:58 root

I can upload the file and create directories and use chown but ./chw00t is not a command it can run.

Compilation error

I'm geting an compilation erro while compileing with the command in the README

root@kali:~/chw00t# gcc chw00t.c -o chw00t -static
chw00t.c: In function 'ptracepid':
chw00t.c:845:29: error: storage size of 'regs' isn't known
     struct user_regs_struct regs;

To compile on gcc 8.3+ add sysmacros.h

#include <sys/sysmacros.h>

is needed to compile or makedev will be unreferenced.

How do you compile this thing

All is in the title

mknod?

A suggestion for -4 option to remount root, in many environments you should be able to call mknod(2) or mknodat(2) to create common device files to try, in addition to searching for them.