Penetration Testing mailing list archives
Re: Gain root access on linux servers with physical access
From: "Aman Raheja" <araheja () techquotes com>
Date: 18 Dec 2006 00:09:15 -0000
Booting with Linux live cd and changing password should work. Let me add to the mix - even after the access is gained a lot of work probably remains to be done, since there could probably be back doors or logic bombs. For example if developer ABC does not login for x number of days, the system will wipe out the code or something worse. Aman Raheja, CISSP http://ar.techquotes.com/weblog On 14 Dec 2006 18:27:15 -0000, spammailme () gmail com wrote :
All - I was wondering ideas on how to gain control of linux boxes with physical
access to them in the hosting facility.
The owner has code on them yet never bothered monitoring or gaining root
access and her developers are blackmailing her. She has access the the hosting facility and the servers and backup staff yet needs to regain control of the servers.
I asked what OS are they? She did not know. nmap cannot tell and p0f
states:
# p0f p0f - passive os fingerprinting utility, version 2.0.8 (C) M. Zalewski <lcamtuf () dione cc>, W. Stearns <wstearns () pobox com> p0f: listening (SYN) on 'eth0', 262 sigs (14 generic, cksum 0F1F5CA2),
rule: 'all'.
x.x.122.x:54368 - Linux 2.6 (newer, 2) (up: 410 hrs) -> x.114.33.x:80 (distance 0, link: ethernet/modem) Any ideas how to get root with physical access? I remember in the past
booting to a knoppix CD and messing with boot loader yet it has been a while.
Also the only ports open are 80 & 443. Any ideas? ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php?
camp=701600000008bOW
------------------------------------------------------------------------
------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW ------------------------------------------------------------------------
Current thread:
- Re: Gain root access on linux servers with physical access, (continued)
- Re: Gain root access on linux servers with physical access Jordan Wiens (Dec 16)
- Re: Gain root access on linux servers with physical access Patrick (Dec 16)
- Re: Gain root access on linux servers with physical access Gadi Evron (Dec 16)
- Re: Gain root access on linux servers with physical access Patrick (Dec 17)
- Re: Gain root access on linux servers with physical access Michael Weber (Dec 19)
- Re: Gain root access on linux servers with physical access Jason Muskat, GCFA, GCUX, de VE3TSJ (Dec 20)
- Re: Gain root access on linux servers with physical access Gadi Evron (Dec 16)
- Re: Gain root access on linux servers with physical access R. DuFresne (Dec 19)