Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Slipping some (non-root) user a piece of malignant code that he or she executes might be considered as one of the highest security breaches possible. (The only higher I can see is actually accessing the root user)

What can an attacker effectively do when he/she gets a standard, (let's say a normal Ubuntu user) to execute code? Where would an attacker go from there? What would that piece of code do?

Let's say that the user is not stupid enough to be lured into entering the root/sudo password into a form/program she doesn't know. Only software from trusted sources is installed.

The way I see it there is not really much one could do, is there?

Addition: I partially ask this because I am thinking of granting some people shell (non-root) access to my server. They should be able to have normal access to programs. I want them to be able to compile programs with gcc. So there will definitely be arbitrary code run in user-space...

share|improve this question
Are you asking "What's the worst that could possibly happen?" – FrustratedWithFormsDesigner Jan 28 '11 at 14:43
This question should belong community wiki. – ulidtko Jan 28 '11 at 22:09
Yes I am asking whats the worst that could happen. – AndreasT Feb 1 '11 at 9:00
up vote 3 down vote accepted

There's a couple of potential issues with an attacker having local shell access to your system.

Firstly is that, if you're not fully up to date with security patches, then it may be possible for the attacker to carry out a privilege escalation attack on binaries on the system. From a linux perspective the main risk would be a vulnerability in a process running as a privileged user. There have been a number of these in the past (for example)

Other ways that an attacker with local privileges can look to escalate would be looking round the file system for credentials or other information which may help them to escalate their privileges, or trying to get a privileged user to execute code that they create which has a malicious purpose.

share|improve this answer

For any normal user it may be possible to perform denial-of-service by resource exhausting. E.g. user may do cat /dev/zero > /tmp/overflow to use out all available disk space or intentionally launch a fork bomb to exhaust CPU and RAM, or flood you primary network interface with rubbish traffic.

You will need to carefully setup all kinds of per-user quotas to prevent this kind of attacks.

share|improve this answer
Thx for this idea, but in my case that would be rather stupid, (not your answer, just the dos attack) since it is easy to know who did it. – AndreasT Feb 1 '11 at 9:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .