{"action":"created","issue":{"url":"https://api.github.com/repos/sektioneins/SUIDGuard/issues/7","labels_url":"https://api.github.com/repos/sektioneins/SUIDGuard/issues/7/labels{/name}","comments_url":"https://api.github.com/repos/sektioneins/SUIDGuard/issues/7/comments","events_url":"https://api.github.com/repos/sektioneins/SUIDGuard/issues/7/events","html_url":"https://github.com/sektioneins/SUIDGuard/issues/7","id":99209868,"number":7,"title":"can't find the tar file mentioned in the discussion","user":{"login":"spalburg","id":1705845,"avatar_url":"https://avatars.githubusercontent.com/u/1705845?v=3","gravatar_id":"","url":"https://api.github.com/users/spalburg","html_url":"https://github.com/spalburg","followers_url":"https://api.github.com/users/spalburg/followers","following_url":"https://api.github.com/users/spalburg/following{/other_user}","gists_url":"https://api.github.com/users/spalburg/gists{/gist_id}","starred_url":"https://api.github.com/users/spalburg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spalburg/subscriptions","organizations_url":"https://api.github.com/users/spalburg/orgs","repos_url":"https://api.github.com/users/spalburg/repos","events_url":"https://api.github.com/users/spalburg/events{/privacy}","received_events_url":"https://api.github.com/users/spalburg/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-08-05T13:55:49Z","updated_at":"2015-08-05T15:32:21Z","closed_at":null,"body":"downloaded the suidguard packages but can't find the tar file mentioned in the discussion\r\nwhere to look ?"},"comment":{"url":"https://api.github.com/repos/sektioneins/SUIDGuard/issues/comments/128041405","html_url":"https://github.com/sektioneins/SUIDGuard/issues/7#issuecomment-128041405","issue_url":"https://api.github.com/repos/sektioneins/SUIDGuard/issues/7","id":128041405,"user":{"login":"spalburg","id":1705845,"avatar_url":"https://avatars.githubusercontent.com/u/1705845?v=3","gravatar_id":"","url":"https://api.github.com/users/spalburg","html_url":"https://github.com/spalburg","followers_url":"https://api.github.com/users/spalburg/followers","following_url":"https://api.github.com/users/spalburg/following{/other_user}","gists_url":"https://api.github.com/users/spalburg/gists{/gist_id}","starred_url":"https://api.github.com/users/spalburg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spalburg/subscriptions","organizations_url":"https://api.github.com/users/spalburg/orgs","repos_url":"https://api.github.com/users/spalburg/repos","events_url":"https://api.github.com/users/spalburg/events{/privacy}","received_events_url":"https://api.github.com/users/spalburg/received_events","type":"User","site_admin":false},"created_at":"2015-08-05T15:32:21Z","updated_at":"2015-08-05T15:32:21Z","body":"i ran your example script\n\n> EDITOR=/usr/bin/true DYLD_PRINT_TO_FILE=/this_system_is_vulnerable crontab -e\n\nls -la /\n\n> On Aug 5, 2015, at 5:27 PM, Stefan Esser <notifications@github.com> wrote:\n> \n> When you say it still has the vulnerability what do you mean?\n> \n> Did you run the example script or one of the one-liner exploits attached to many media articles? If you did so then you \"backdoored\" your system. If you used our exploit then you will find /usr/bin/boomsh which provides a rootshell. You have to delete it manually after trying out the exploit. If you tried out the one-liner exploits floating around then you have new entries in the /etc/sudoers file that allow everyone to sudo without a password.\n> \n> In anyway: if you ran any of the exploits on your system and did not undo the damage they caused - re-running them with SUIDGuard loaded will make it look like SUIDGuard failed, but in reality the re-run exploits made use of the already backdoored system.\n> \n> —\n> Reply to this email directly or view it on GitHub <https://github.com/sektioneins/SUIDGuard/issues/7#issuecomment-128038591>.\n> \n\n"}}