+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Tutorial]How i Rooted a 2011 Kernel box [/Tutorial] (/showthread.php?tid=2328754)
* - thethatguy - Mar 23, 2012
Brilliant job mate. Ignore netcat he's a jelly idiot.
You used your own brain here and you can release this as a new public exploit if you want. 5 stars mate.
* - syngress - Mar 23, 2012
This is so much more HQ that the shitty XSS threads going around. Please release more of these, aswell as tutes!!
* - orunu - Mar 23, 2012
(Mar 22, 2012 08:43 PM)joomlafkr Wrote: Bash is the default shell for linux and MAC , for windows you know , there is dos !
here is a wikipedia article about it :
http://en.wikipedia.org/wiki/Bash_(Unix_shell)
Writing shell script isn't hard , i can recommend you some books !
about shellcode it's mainly Assembly , it's about executing microprocessor commands and bypassing OS restrictions...
assembly isn't hard aswell,if you master it , one day you will come up with a linux kernel 0-day !
how can assembly help u exploit a linux box? i though assembly was for writing windows virus'
* - Bacardi - Mar 23, 2012
Very nice tutorial. I bookmarked it for future use.
Well done.
* - 0x414141 - Mar 23, 2012
ASM is kind of cross platform - you can compile it for specific platform and run it.
Anyways, nice job on this! I remember ages back a certain server was shelled. CRON was running a shell script every minute as root. The shell script was chmod 777. A reverse shell command was appended to the script and a minute later a reverse shell was obtained. The script was cleaned up, SSH priv keys exported, and box owned.
I think you can figure out what that vague paragraph means... No specifics are given for obv reasons as the persons involved in the incident later went whitehat.
The trick with owning boxes is to think outside the box. For example, a simple XSS in vbSEO became a reverse shell when MaXe thought about it for a while. My co-worker, infodox, found a "non exploitable" file upload form in a certain web app he was auditing. He read through the source and realized it was, in fact, exploitable if you thought it through - the developers thought by renaming files uploaded they could prevent shells from working. It left the .php extension intact, and the "name" they gave was simply a MD5 hash of the original filename. Exploitation was as simple as naming the shell something.php, and getting the MD5 of "something", uploading shell, and calling "md5 of something".php from the /uploads/ dir, which was never correctly chmodded by the installer script.
Another trick is command injection/insertion flaws in SUID binaries - suid binary -arg1 `command` -arg2 has been known to work in poorly crafted programs.
* - Bacardi - Mar 23, 2012
I read the sentence wrong.
Could you send me the batch script please? Thanks.
* - Nitai - Mar 23, 2012
wow, good tutorial very much thanks ! you a the MAN ;)
* - joomlafkr - Mar 23, 2012
Thanks guys for your comments , really constructive !
i sent the downlaod link to those who requested it!
0x414141 : my bad , i could spawn directly a reverse shell ,since the CRON job was launched with root privileges !
but i wanted to make sure i get the password , since Redhat asks you for the password each time you wanna make something suspicious ( like adding a root user.... ) , but yeah you are right !
* - 0x414141 - Mar 23, 2012
joomlafkr - for adding root users just directly edit the requisite files: /etc/passwd and /etc/shadow. Just append to the end of them, and set homedir to /home/... (you can make a dir ... that most admins overlook). Problem solved?
(you may need to edit other files, depends on the box. I have not played with RH in a while)
* - SIM-974023 - Mar 23, 2012
Very smart, I liked how you completed the root.
* - The Ion - Mar 23, 2012
Very nice tutorial. I bookmarked it for future use.
Well done.
NICE hQ shit in middle of these LQ shits
* - cheatson - Mar 23, 2012
Very nice, yet another excellent contribution by a real hacker! =]
* - joomlafkr - Mar 23, 2012
(Mar 23, 2012 09:14 AM)cheatson Wrote: Very nice, yet another excellent contribution by a real hacker! =]
Thanks mate !
Apreciate it , hope it comes handy someday !
* - noober1001 - Mar 24, 2012
That's some fuckin awesome.
I wish I could think like this.
Keep it up bro.
* - PaulEM - Mar 25, 2012
very good technique :D
Send me the code please and thanks :D
Waiting :)