Study the following exploit code taken from a Linux machine and answer the questions below:
echo "ingreslock stream tcp nowait root /bin/sh sh I" > /tmp/x;
/usr/sbin/inetd s /tmp/x;
sleep 10;
/bin/ rm f /tmp/x AAAA…AAA
In the above exploit code, the command "/bin/sh sh I" is given.
What is the purpose, and why is `sh’ shown twice?
A.
The command /bin/sh sh �i appearing in the exploit code is actually part of an inetd configuration file.
B.
The length of such a buffer overflow exploit makes it prohibitive for user to enter manually.
The second `sh’ automates this function.
C.
It checks for the presence of a codeword (setting the environment variable) among the environment variables.
D.
It is a giveaway by the attacker that he is a script kiddy.
Explanation:
What’s going on in the above question is the attacker is trying to write to the unix filed /tm/x (his inetd.conf replacement config) — he is attempting to add a service called ingresslock (which doesnt exist), which is "apparently" suppose to spawn a shell the given port specified by /etc/services for the service "ingresslock", ingresslock is a non-existant service, and if an attempt were made to respawn inetd, the service would error out on that line. (he would have to add the service to /etc/services to suppress the error). Now the question is asking about /bin/sh sh -i which produces an error that should read "sh: /bin/sh: cannot execute binary file", the -i option places the shell in interactive mode and cannot be used to respawn itself.