Hacker News Reader

Comment by prepend | Hacker News Reader

How does the image get executed? I went through the article and in the example the author extracts the executable manually using dd.

But how would an unsuspecting user run the executable? Perhaps I missed this, but is there some image viewer or browser that runs the trailing bytes of images?

View on HN

I was hoping for some sort of image or binary processing exploit too, but the attack just uses a Postgres vulnerability to execute arbitrary shell code. [0][1] The fact that the executed code was buried in an image seems to just be a camouflage step for the attacker.

0. https://github.com/nixawk/pentest-wiki/blob/master/2.Vulnera... 1. https://www.rapid7.com/db/modules/exploit/linux/postgres/pos...

There's no exploit here, superusers can do things, that's it.

It's executed from PostgreSQL - the article shows SQL queries containing shell commands. This is a way for an attacker who's already obtained the ability to run arbitrary queries against a PostgreSQL server to run an exploitation payload there; the real solution is not to let the attacker get into that situation.

Thanks.

Is there a name for these kind of contingent exploits? If step 1 is get root/execute code, it it reduces the risk of the exploit.

Still valuable to know about, but not that much if you can execute code on a server.

The "exploit" is the part where the attacker gets root/remote code execution. Using the computer to mine cryptocurrency rather than participate in DDOS attacks or host child porn is just a detail.

Getting from "execute arbitrary SQL queries" to "execute specific exploit code" is not a completely trivial step, though of course it's not the most important part.

Reply on news.ycombinator.com