Aggregator

Today I’m gonna talk about a class of application security issues I ran across a few times over the years. In particular, let’s discuss race conditions when it comes to files with sensitive content and permissions.

Race conditions can allow an adversary to gain access to sensitive information on machines. Assume a system creates a file that contains sensitive information and afterwards applies permissions to lockdown that file.

Let’s look at a practical example seen in the wild a few times. Imagine code like this:

一次遇到案例，利用部分工具无法有效实现执行、回显，于是有了此篇