 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 97
 Members: 0
 Total: 97
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
Debian root exploit |
|
 Posted: Sat Jul 23, 2005 1:54 pm |
 |
|
| chr11223 |
| Beginner |
 |
|
| Joined: Jul 23, 2005 |
| Posts: 1 |
|
|
|
 |
|
 |
|
hello,
(sorry for my bad english but i am from germany)
I have lost the root password to my virtual-rootserver.
The Server is using confixx and I have access to the web1 account with ssh
Its a debian Server with 2.4 Kernel
I tried the following eploits
raptor_chown (it works but it only changes the group to my gorup for the file. it doesnt change the owner to me  )
-rw-r----- 1 root ftponly 1406 Jul 22 02:25 /etc/shadow
The exploit gave me group access to the shadow but only r-- so i got
root:$1$zFigglP/$5a8oBKkKAnQ037SXqNFPf.:12974:0:99999:7:::
but i don't know how to decrypt the password. I uses john but its to slow
Than this:
./mremap_pte
[+] kernel 2.4.20-021stab028.12.777-enterprise vulnerable: YES exploitable YES
MMAP #27136 0x47600000 - 0x47601000
[-] Failed
It says yes exploitable but then failed
I dont know what i can do now.
Does someone of you know a good exploit? |
|
|
|
|
|
|
|
|
| Posted: Sun Jul 24, 2005 9:06 am |
|
|
| shai-tan |
| Valuable expert |
 |
|
| Joined: Feb 22, 2005 |
| Posts: 477 |
|
|
|
|
|
|
|
Thought about using a rootkit?
You can find some good ones on LINUX's site. | Code: | | http://www.sosvulnerable.net |
|
|
_________________
Shai-tan
?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds |
|
|
|
|
Re: Debian root exploit |
|
| Posted: Tue Jul 26, 2005 2:15 pm |
|
|
| LINUX |
| Moderator |
|
|
| Joined: May 24, 2004 |
| Posts: 404 |
| Location: Caiman |
|
|
|
|
|
|
| chr11223 wrote: | hello,
(sorry for my bad english but i am from germany)
I have lost the root password to my virtual-rootserver.
The Server is using confixx and I have access to the web1 account with ssh
Its a debian Server with 2.4 Kernel
I tried the following eploits
raptor_chown (it works but it only changes the group to my gorup for the file. it doesnt change the owner to me )
-rw-r----- 1 root ftponly 1406 Jul 22 02:25 /etc/shadow
The exploit gave me group access to the shadow but only r-- so i got
root:$1$zFigglP/$5a8oBKkKAnQ037SXqNFPf.:12974:0:99999:7:::
but i don't know how to decrypt the password. I uses john but its to slow
Than this:
./mremap_pte
[+] kernel 2.4.20-021stab028.12.777-enterprise vulnerable: YES exploitable YES
MMAP #27136 0x47600000 - 0x47601000
[-] Failed
It says yes exploitable but then failed
I dont know what i can do now.
Does someone of you know a good exploit? |
this is you kernel 2.4.20-021stab028.12.777, what year is you kernel ?
uname -a paste here
i think you kernel is MSD 2005 i686 > if is this not is possible root |
|
|
|
|
|
|
|
|
| Posted: Thu Mar 23, 2006 2:26 pm |
|
|
| Classics |
| Regular user |
 |
|
| Joined: Mar 23, 2006 |
| Posts: 6 |
| Location: Nederland/Venlo |
|
|
|
|
|
|
@shai-tan
Your Side is Offline
You have a other Big Side for Linux/FreeBSD ?
Thanks
Classics |
|
|
|
|
| Posted: Thu Mar 23, 2006 10:24 pm |
|
|
| fizzi |
| Advanced user |
|
|
| Joined: Sep 14, 2005 |
| Posts: 55 |
|
|
|
|
|
|
|
If John failes (e.g. due to lack of time) backup your files and ask your rootserver-provider for a reset
Or try some exploits from milw0rm:
http://www.milw0rm.com/search.php?dong=linux+kernel
there are some exploits for 2.4 and 2.6 mainlines, they should work four you too |
|
|
|
|
www.waraxe.us Forum Index -> Newbies corner
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
