Part 6/12:
The attacker leverages a timing-based approach by:
Creating a malicious filesystem image with
setuidbinaries, such as a root-privileged shell.Mounting this filesystem on the target system with the standard mount command, which, depending on options, can ignore
no setuidflags temporarily.Using a loop, that effectively keeps the filesystem mounted and busy, preventing it from being unmounted.
Replacing or injecting malicious
setuidbinaries into this mounted filesystem while it remains active.Executing the binary during the window where the filesystem is mounted with elevated privileges.