Restricted Shells: Sometimes Persuasive but Usually Fallacious

Re:Restricted Shells: Sometimes Persuasive but Usually Falla... by schoen on Wednesday March 13, 2019 @05:07PM (#19383793)

Restricted shell escapes are a common topic in CTFs and they can be a very interesting test of one's knowledge of shell and Unix details. It's not clear to me whether people who commonly construct these challenges think that a restricted shell can actually be safe or not.

(It's clear that to attempt to have a safe restricted shell, you have to, among other things, whitelist rather than blacklist executable programs, studying each one individually to learn whether it allows arbitrary code execution or not.)

[ Parent | on HN ]

Re:Restricted Shells: Sometimes Persuasive but Usually Falla... by lvh on Wednesday March 13, 2019 @05:34PM (#19384095)

It also doesn't help that when some people say restricted shell they mean "actually like bash, running on a real system", or more of a debugging console (a bespoke REPL a la Python's stdlib's cmd module). I'd happily believe you can secure something like the latter, and I don't think it's worth the expense of securing the former.

(But also, if you give people an anodyne shell like that, what's the point? If all you can do is peek and poke at metrics then maybe you just wanted better instrumentation?)

[ Parent | on HN ]