From 0b2b9741d3a9b0bea433f5044c98247886752a5c Mon Sep 17 00:00:00 2001 From: Leo Date: Fri, 5 Jun 2026 10:42:30 +0200 Subject: [PATCH] feat: solve ex 1 --- sheet06/a1/a.txt | 16 ++++++++++++++++ sheet06/a1/b.txt | 21 +++++++++++++++++++++ 2 files changed, 37 insertions(+) create mode 100644 sheet06/a1/a.txt create mode 100644 sheet06/a1/b.txt diff --git a/sheet06/a1/a.txt b/sheet06/a1/a.txt new file mode 100644 index 0000000..d37b008 --- /dev/null +++ b/sheet06/a1/a.txt @@ -0,0 +1,16 @@ +10:16:36 leo@group-20 ~ → sudo chmod u-s /bin/ping +10:18:59 leo@group-20 ~ → ping google.com +ping: socktype: SOCK_RAW +ping: socket: Operation not permitted +ping: => missing cap_net_raw+p capability or setuid? +10:19:03 leo@group-20 ~ → sudo setcap cap_net_raw+ep /bin/ping +10:19:48 leo@group-20 ~ → ping google.com +PING google.com (142.251.20.138) 56(84) bytes of data. +64 bytes from bx-in-f138.1e100.net (142.251.20.138): icmp_seq=1 ttl=112 time=10.5 ms +64 bytes from bx-in-f138.1e100.net (142.251.20.138): icmp_seq=2 ttl=112 time=9.83 ms + +The capability is required because ping sends ICMP packets to function. +It has to create raw network sockets and for that the kernel needs the cap_net_raw capability. + +The permitted set grants the executable the right to posess this capability. +The effective set is needed because ping is not programmed to automatically set the effective set on runtime which is needed for the program to open the raw socket immediately. diff --git a/sheet06/a1/b.txt b/sheet06/a1/b.txt new file mode 100644 index 0000000..04e3440 --- /dev/null +++ b/sheet06/a1/b.txt @@ -0,0 +1,21 @@ +10:31:48 leo@group-20 ~ → ls -l /bin/netcat +lrwxrwxrwx 1 root root 24 Apr 8 2024 /bin/netcat -> /etc/alternatives/netcat +10:31:57 leo@group-20 ~ → ls -l /etc/alternatives/netcat +lrwxrwxrwx 1 root root 15 Apr 8 2024 /etc/alternatives/netcat -> /bin/nc.openbsd +10:32:11 leo@group-20 ~ → ls -l /bin/nc.openbsd +-rwxr-xr-x 1 root root 39560 Apr 8 2024 /bin/nc.openbsd +10:31:38 leo@group-20 ~ → sudo setcap cap_net_bind_service+ep /bin/nc.openbsd +10:32:46 leo@group-20 ~ → netcat -l 81 +GET / HTTP/1.1 +Host: 10.42.23.30:81 +User-Agent: curl/8.20.0 +Accept: */* +leo@leo-laptop:~$ curl 10.42.23.30:81 +^C + + + +On linux ports 0-1023 are privileged ports to which only the root user can bind by default. +By setting the cap_net_bind_service capability the executable can also bind to those lower ports. +/bin/netcat is only a symlink leading to /etc/alternatives/netcat which is a symlink leading to /bin/nc.openbsd. +The capabilities are stored in the file's inode. Because symlinks do not support extended attributes in this way the capability has to be stored on the target executable. \ No newline at end of file