pen-test
[Top] [All Lists]

Re: Gain root access on linux servers with physical access

To: spammailme@gmail.com
Subject: Re: Gain root access on linux servers with physical access
From: Jordan Wiens <numatrix@ufl.edu>
Date: Sat, 16 Dec 2006 17:44:38 -0500
Cc: pen-test@securityfocus.com
Delivered-to: sp-com-lists@consult.net
Delivered-to: pentest-list2@consult.net
Delivered-to: mailing list pen-test@securityfocus.com
Delivered-to: moderator for pen-test@securityfocus.com
In-reply-to: <20061214182715.2903.qmail@securityfocus.com>
List-help: <mailto:pen-test-help@securityfocus.com>
List-id: <pen-test.list-id.securityfocus.com>
List-post: <mailto:pen-test@securityfocus.com>
List-subscribe: <mailto:pen-test-subscribe@securityfocus.com>
List-unsubscribe: <mailto:pen-test-unsubscribe@securityfocus.com>
Mailing-list: contact pen-test-help@securityfocus.com; run by ezmlm
References: <20061214182715.2903.qmail@securityfocus.com>
Resent-date: Sat, 16 Dec 2006 16:32:55 -0700 (MST)
Resent-from: pen-test-return-1078483234@securityfocus.com
Resent-message-id: <20061216233255.3D77F236FD6@outgoing3.securityfocus.com>
Resent-sender: listbounce@securityfocus.com
Sender: listbounce@securityfocus.com
User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.8) Gecko/20061115 Thunderbird/1.5.0.8 Mnenhy/0.7.4.0
http://linuxgazette.net/107/tomar.html

Basically, boot the boot loader in single-user mode, change password and reboot. If the bootloader is password protected, boot from external media, manually edit the password file or use chroot and passwd, reboot without media, login.

--
Jordan Wiens, CISSP
UF Network Security Engineer
(352)392-2061


spammailme@gmail.com wrote:
All -

I was wondering ideas on how to gain control of linux boxes with physical access to them in the hosting facility.
The owner has code on them yet never bothered monitoring or gaining root access 
and her developers are blackmailing her. She has access the the hosting 
facility and the servers and backup staff yet needs to regain control of the 
servers.

I asked what OS are they? She did not know. nmap cannot tell and p0f states:
# p0f
p0f - passive os fingerprinting utility, version 2.0.8
(C) M. Zalewski <lcamtuf@dione.cc>, W. Stearns <wstearns@pobox.com>
p0f: listening (SYN) on 'eth0', 262 sigs (14 generic, cksum 0F1F5CA2), rule: 
'all'.
x.x.122.x:54368 - Linux 2.6 (newer, 2) (up: 410 hrs)
  -> x.114.33.x:80 (distance 0, link: ethernet/modem)

Any ideas how to get root with physical access? I remember in the past booting 
to a knoppix CD and messing with boot loader yet it has been a while.

Also the only ports open are 80 & 443.

Any ideas?



------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------



------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------


<Prev in Thread] Current Thread [Next in Thread>