On Oct 25, 2016 06:48, "William Roberts" <<a href="mailto:bill.c.roberts@gmail.com">bill.c.roberts@gmail.com</a>> wrote: > > On Oct 25, 2016 06:42, "teroz" <<a href="mailto:terence.namusonge@gmail.com">terence.namusonge@gmail.com</a>> wrote: > > > > Hey William > > exploit is run as a normal user and privilege escalates to a root shell > > > > Look under the covers. Dirty cow allows arbitrary file modification, so somewhere it's likely executing some setuid root thing that it modifies. Take a peak with strace. Sorry too early in the morning for me, this doesn't require setuid modification, just a file owned by root looking at the source: <a href="https://github.com/dirtycow/dirtycow.github.io/blob/master/dirtyc0w.c">https://github.com/dirtycow/dirtycow.github.io/blob/master/dirtyc0w.c</a> > > <a href="https://www.google.com/amp/www.theregister.co.uk/AMP/2016/10/21/linux_privilege_escalation_hole/">https://www.google.com/amp/www.theregister.co.uk/AMP/2016/10/21/linux_privilege_escalation_hole/</a> > > > On Tue, 25 Oct 2016 at 15:09 William Roberts <<a href="mailto:bill.c.roberts@gmail.com">bill.c.roberts@gmail.com</a>> wrote: > >> > >> On Oct 25, 2016 05:12, "teroz" <<a href="mailto:terence.namusonge@gmail.com">terence.namusonge@gmail.com</a>> wrote: > >> > > >> > I used one of the dirtycow root exploits on Fedora24 configured with 30-pci-dss-v31.rules. I was expecting an ANOM_ROOT_TRANS record but didn't get one. What triggers an ANOM_ROOT_TRANS record? What then is the best way to trivially audit for a successful privilege escalation? > >> > > >> > >> I would imagine that if it's hijacking an already root or setuid binary, you won't see anything. As far as that record goes, I have no idea, I'll let an auditing expert answer that question. > >> > > >> > > >> > > >> > >> > >> > > >> > -- > >> > Linux-audit mailing list > >> > <a href="mailto:Linux-audit@redhat.com">Linux-audit@redhat.com</a> > >> > <a href="https://www.redhat.com/mailman/listinfo/linux-audit">https://www.redhat.com/mailman/listinfo/linux-audit</a>