IT-Sec_Group_K/it-sec-exercises
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 8 Wiki Activity

feat: solve ex 1
All checks were successful
zip and release / build-and-release (push) Successful in 6s
Details

Browse Source
This commit is contained in:
Leo
2026-06-05 10:42:30 +02:00
parent 4ff7e162ac
commit 0b2b9741d3
2 changed files with 37 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
sheet06/a1/a.txt Normal file
View File

@@ -0,0 +1,16 @@
10:16:36 leo@group-20 ~ → sudo chmod u-s /bin/ping
10:18:59 leo@group-20 ~ → ping google.com
ping: socktype: SOCK_RAW
ping: socket: Operation not permitted
ping: => missing cap_net_raw+p capability or setuid?
10:19:03 leo@group-20 ~ → sudo setcap cap_net_raw+ep /bin/ping
10:19:48 leo@group-20 ~ → ping google.com
PING google.com (142.251.20.138) 56(84) bytes of data.
64 bytes from bx-in-f138.1e100.net (142.251.20.138): icmp_seq=1 ttl=112 time=10.5 ms
64 bytes from bx-in-f138.1e100.net (142.251.20.138): icmp_seq=2 ttl=112 time=9.83 ms
The capability is required because ping sends ICMP packets to function.
It has to create raw network sockets and for that the kernel needs the cap_net_raw capability.
The permitted set grants the executable the right to posess this capability.
The effective set is needed because ping is not programmed to automatically set the effective set on runtime which is needed for the program to open the raw socket immediately.

21
sheet06/a1/b.txt Normal file
View File

@@ -0,0 +1,21 @@
10:31:48 leo@group-20 ~ → ls -l /bin/netcat
lrwxrwxrwx 1 root root 24 Apr 8 2024 /bin/netcat -> /etc/alternatives/netcat
10:31:57 leo@group-20 ~ → ls -l /etc/alternatives/netcat
lrwxrwxrwx 1 root root 15 Apr 8 2024 /etc/alternatives/netcat -> /bin/nc.openbsd
10:32:11 leo@group-20 ~ → ls -l /bin/nc.openbsd
-rwxr-xr-x 1 root root 39560 Apr 8 2024 /bin/nc.openbsd
10:31:38 leo@group-20 ~ → sudo setcap cap_net_bind_service+ep /bin/nc.openbsd
10:32:46 leo@group-20 ~ → netcat -l 81
GET / HTTP/1.1
Host: 10.42.23.30:81
User-Agent: curl/8.20.0
Accept: */*
leo@leo-laptop:~$ curl 10.42.23.30:81
^C
On linux ports 0-1023 are privileged ports to which only the root user can bind by default.
By setting the cap_net_bind_service capability the executable can also bind to those lower ports.
/bin/netcat is only a symlink leading to /etc/alternatives/netcat which is a symlink leading to /bin/nc.openbsd.
The capabilities are stored in the file's inode. Because symlinks do not support extended attributes in this way the capability has to be stored on the target executable.