 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 107
 Members: 0
 Total: 107
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
Local Linux Server Hacking |
|
 Posted: Thu Mar 23, 2006 11:39 pm |
 |
|
| newboy |
| Regular user |
 |
|
| Joined: Mar 24, 2006 |
| Posts: 10 |
|
|
|
 |
|
 |
|
we have a server
Kernel: Linux *.Server.com2.6.15.4-AMDv7 #2 SMP Mon Feb 13 05:07:27 CST 2006 x86_64 x86_64 x86_64 GNU/Linux
our ID is
ID: uid=99(nobody) gid=99(nobody) groups=99(nobody)
and we can wget on server and we have access on /tmp
wtf can i do to get root ? |
|
|
|
|
| Posted: Fri Mar 24, 2006 4:25 am |
|
|
| newboy |
| Regular user |
|
|
| Joined: Mar 24, 2006 |
| Posts: 10 |
|
|
|
|
|
|
|
|
|
|
|
| Posted: Fri Mar 24, 2006 8:59 am |
|
|
| fizzi |
| Advanced user |
|
|
| Joined: Sep 14, 2005 |
| Posts: 55 |
|
|
|
|
|
|
|
|
|
|
|
| Posted: Fri Mar 24, 2006 3:14 pm |
|
|
| newboy |
| Regular user |
|
|
| Joined: Mar 24, 2006 |
| Posts: 10 |
|
|
|
|
|
|
|
thnx fizzi
but the problem is that it's not my server and i have a shell on it & it's limited |
|
|
|
|
| Posted: Fri Mar 24, 2006 6:54 pm |
|
|
| fizzi |
| Advanced user |
|
|
| Joined: Sep 14, 2005 |
| Posts: 55 |
|
|
|
|
|
|
|
mhm. perhaps you want to find some setuid/setgid programs on that machine which are vulnerable?
find / -perm +a+s -type f -ls
or try to detect services on that machine which are running and perhaps vulnerable, using a portscan (remote & local)
/tmp could also be useful for symlinks-attacks, but that depends on the services your machine is running.
there was also a message on the bugtraq maillinglist http://seclists.org/lists/bugtraq/2006/Mar/0442.html regarding su/sudo tricking. perhaps you can exploit some sudo scripts? (i havent read that message through entirely)
good luck!  |
|
|
|
|
| Posted: Fri Mar 24, 2006 8:01 pm |
|
|
| newboy |
| Regular user |
|
|
| Joined: Mar 24, 2006 |
| Posts: 10 |
|
|
|
|
|
|
|
i think this server is unrootable but tnx for your useful help fizzi
but which port & vuln scanner can be run in bash shell with my low access ? 
is there any local exploit for this kernel & this year ???? i did'nt find !! |
|
|
|
|
| Posted: Fri Mar 24, 2006 10:19 pm |
|
|
| fizzi |
| Advanced user |
|
|
| Joined: Sep 14, 2005 |
| Posts: 55 |
|
|
|
|
|
|
|
use nmap to portscan, unless you have no root rights, you can't perform several tasks with nmap, but at least you can see if there is a firewall, which keeps your remote computer away from connecting to special services
and no, i don't know any kernel bugs related to that kernel version so far |
|
|
|
|
| Posted: Sat Mar 25, 2006 6:41 am |
|
|
| newboy |
| Regular user |
|
|
| Joined: Mar 24, 2006 |
| Posts: 10 |
|
|
|
|
|
|
|
tanx fizzi, you helped me to found my answers and now i know what can i do  |
|
|
|
|
www.waraxe.us Forum Index -> Newbies corner
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
