@user2284570 They do. There are several algorithms that can be used to implement FSMs. FSMs are a mathematical object that must be modelled in a computer.
Each of those algorithms can be implemented correctly or incorrectly. Whether or not you get segfaults is down to how buggy your implementation of an FSM model is.
@Tinned_Tuna : I’m not talking about the state machine implementation by ragek, but about the finite state itself (in my case, the input is a pointer).
@Tinned_Tuna : thank you, but I already know the way finite state machines are implemented in ragel are secure. My question is about a specific state machine.
well firstly to make sense of your post (i find communication difficult) it is possible to push form user to root? so if the app is being run via su as user but the process is root ... I can in theory get root access via the push back (assuming all other conditions in place)
but **only** under the condition that the user shell was started as root.
therefore the TTY pushback is a pretty bad technique for privilege escalation on the same machine.
this is because almost no one performs su - user.
instead a getty process (agetty, mingetty or other variation) gives out the TTY to the user terminal.
if you do a ps -afe | grep getty you will find several getty processes (you may need to do Ctrl+Alt+F1, F2, F3, ... on some systems to actually trigger the getty's though)
When you login through getty the root process goes away and it hands it over to a login program and then bash. The login program is detached from the TTY, so a pushback is not possible in that case
@grochmal well yea in this circumstance / scenario the su user was started by root (to run a web server as user but was kicked off by the su user /etc/bin/apache2 start) ...I can get into a shell using an apache2 exploit no problemo, but now the problem is pushing back... I tried a few push back scripts but kept getting something about insufficiant octels
Heh, that's an approach i didn't think of. Let's think: when you start, say, apache2 you're doing it through init (i.e. systemd on most systems today). Therefore, there is no TTY attached to that process.
Yet, when you exploit the apache you perform an exec(/bin/sh) and that need to have a TTY to echo stuff back to you.
The question is what TTY is used.
Or whether there really need to be a TTY there. Let me make a quick test.
[Service] ExecStart=-/bin/cat StandardInput=socket ``` When I boot it (`systemctl start echo.socket`), i get something very similar to apache
When I telnet localhost 1337 systemd spawns a /bin/cat process that echoes back what i type. That is the same spawn behaviour of apache, plus the same bahaviour of a shell in an exploit
But the nice part comes when (with the connection open) I search for the cat process that is doing the echos: ``` ps -afe | grep cat root 4430 1 0 21:42 ? 00:00:00 /bin/cat root 4432 600 0 21:42 pts/2 00:00:00 grep cat ```
No TTY!
Therefore any syscalls through tty_ioctl will silently fail (well, probably silently) in that scenario because there is no TTY to get them.
The ? in there is the process without a TTY. But the grep used has a TTY
basically, ps -afe (or ps aux if you're on something like openBSD) will tell you the processes that have a TTY attached. Your shell has it's own PID in $$, therefore ps -afe | grep $$ will give you info whether your current shell (through an exploit or not) has a TTY attached (tty and pts are good, ? is bad)
In the real world though i'd find it very very very difficult to find a shell exploitable in this way. Badly designed routers maybe, and yeah IoT :)
