+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Linux files to steal (/showthread.php?tid=5647420)
Linux files to steal - vorticalbox - Jun 15, 2017
I have a system set up in a VM that is running DB as root and is purposely SQLi , however It also doesn't disclose the file system at all.
So I know that I can read/write files so where do I go from here?
How do I go about finding the /www folder so I can install a back door?
I have downloaded the /etc/passwd file but that isn't giving me the information I am after.
* - Rafaelinio - Jun 15, 2017
First of all i think the "/www" folder you are referring to is located at "/var/www"
the /etc/passwd file just contains local users. The file you're probably after is /etc/shadow which contains the systems password but its hashed so you'll have to crack it.
You might also want to add your ssh key in the machines ~/.ssh folder so you can access it at any time through ssh
* - vorticalbox - Jun 15, 2017
(Jun 15, 2017 08:00 AM)Rafaelinio Wrote: First of all i think the "/www" folder you are referring to is located at "/var/www"
the /etc/passwd file just contains local users. The file you're probably after is /etc/shadow which contains the systems password but its hashed so you'll have to crack it.
You might also want to add your ssh key in the machines ~/.ssh folder so you can access it at any time through ssh
how do I add a key?
* - Rafaelinio - Jun 15, 2017
Generate one on your attack machine using:
root@ubuntu:~# ssh-keygen
Then upload the .pub file that will be generated to the victim machine and append to the authorized keys like so
cat <your public key>.pub >> ~/.ssh/authorized_keys
you can now connect to it using ssh <victims_ip>
anyway you can just google this....
* - vorticalbox - Jun 16, 2017
(Jun 15, 2017 08:20 AM)Rafaelinio Wrote: Generate one on your attack machine using:
root@ubuntu:~# ssh-keygen
Then upload the .pub file that will be generated to the victim machine and append to the authorized keys like so
cat <your public key>.pub >> ~/.ssh/authorized_keys
you can now connect to it using ssh <victims_ip>
anyway you can just google this....
Thanks, what if ssh disabled? Seeing as i cant find where the www folder is i have no idea where to write a backdoor.
* - Rafaelinio - Jun 16, 2017
How are you gonna write a backdoor if you don't know the basics of linux? grab yourself a book and familiarize with the linux filesystem, commands etc.
* - _bengi - Jun 17, 2017
Just write to /etc/shadow. It's really not that difficult.
* - vorticalbox - Jun 18, 2017
(Jun 16, 2017 09:15 AM)Rafaelinio Wrote: How are you gonna write a backdoor if you don't know the basics of linux? grab yourself a book and familiarize with the linux filesystem, commands etc.
My problem is finding the www documents, i my have lied in the op its not a vm.
The webserver is running solaris, i tried all the normal www folders and no luck, i guess the next step is to upload a backdoor and run it on the machine rather than via a web folder based on?
* - _bengi - Jun 18, 2017
(Jun 18, 2017 12:37 AM)vorticalbox Wrote: My problem is finding the www documents, i my have lied in the op its not a vm.
The webserver is running solaris, i tried all the normal www folders and no luck, i guess the next step is to upload a backdoor and run it on the machine rather than via a web folder based on?
You can predict the document root with knowledge of the web server software.
* - VizOne - Jun 18, 2017
i am stil stuck on finding kernel exploit
* - vorticalbox - Jun 19, 2017
(Jun 18, 2017 09:42 AM)_bengi Wrote: You can predict the document root with knowledge of the web server software.
(Jun 18, 2017 03:03 PM)VizOne Wrote: i am stil stuck on finding kernel exploit
I stole /etc/syslog.confg and got this
#ident "@(#)syslog.conf 1.5 98/12/14 SMI" /* SunOS 5.0 */