Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 11 Aug 2015 17:59:17 -0400
From: Steve Grubb <>
Cc: Andy Lutomirski <>,
        Daniel Kahn Gillmor <>,
        Kurt Seifried <>
Subject: Re: Re: Terminal escape sequences - the new XSS for admins?

On Tuesday, August 11, 2015 02:40:12 PM Andy Lutomirski wrote:
> > At this point, I was convinced that most major emulators are safe. That
> > said...there are all the ones I didn't check including older ones. The
> > older ones are likely to be the ones I'd be most concerned about.
> Are all the supposedly invulnerable terminals actually safe? 
> Gnome-terminal reports:
> 0000000: 1b5d 6c54 6572 6d69 6e61 6c1b 5c       .]lTerminal.\
> That's not as bad as echoing 'ls -al' back to the terminal input, but 
> why is it considered acceptable for terminals to input anything 
> whatsoever in response to the in-band data they receive?

The whole idea is to write something that you can bounce back to the prompt. 
lTerminal is pretty limiting. An attacker would have to also place the file 
lTerminal in the search path before using this trick. But if they can do pre-
place a file in the search path, they can also take advantage of typing 
mistakes like placing a file vo and then waiting for the admin to make a 
mistake typing vi.

What you really want to do in an attack is to  try placing a call back shell 
command on the prompt or download/upload files.

Most terminal emulators, konsole for example, reply with nothing. Its the vte 
based ones that reply like this.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.