Question

Assume that there is a system call connect(). This system call takes an IP address as an argument and then creates a TCP connection with that IP address. For example, connect(10.10.10.10) will create a TCP connection with the machine that has the IP address 10.10.10.10. Now, imagine that for the ptrace sandbox, the connect() system call is blocked for a known bad IP address 20.20.20.20. However, the attacker wants to connect to this blocked IP address (the attacker wants a TCP connection to 20.20.20.20, which is not allowed in the policy). It is also given that the connect() system call is allowed for the IP address 1.1.1.1. What can the attacker do to bypass this restriction and trick the ptrace sandbox (and the Operating System) into running the connect() system call with the argument 20.20.20.207 Show word count

Answer 1

The attacker can mount attack against kernel API to gain root.

He can connect to RFC1918 netwroks to bypass firefalls

He can mess any shared object with inadequate permissions.

He can attach localhost servcies.

Abuse CPU/bandwidth