Hello !
I am a studen in computer science (first year) and we have to acess a ssh server, we have a username and password, and we msut execute a file from another user (lets say i am user1@machine.com and i must copy the file "FILE" from the user "root")
The problem is the file "FILE" is protected from reading (or writing or executing) so do anyone have any idea ?
Name:
Anonymous2013-09-10 8:45
Well if the hint is to utilize the environment variables, the following won't apply.
But you could, load up another OS, mount this *nix OS, copy /etc/shadow and /etc/passwd, then run it through JTR or another hash cracking tool, since if this a challenge set by your teacher and not some other machine your trying to hack into, the hashed password would probably be possible to dict attack.
Any back to your ENV variables. Run nmap -v on 192.168.0.115:1337, or if you don't have nmap and can't compile, you can instead banner grab to detect SSH service version. In all likelihood, it is probably an old SSH service, hence many exploits available. Problem is things like MSF need root for installation, so you can't just run public exploits, unless they are public standalone source exploits.
There are also many standalone sources which can escalate privileges to root through kernel exploits.
Anyway I'm starting to share too much of my BH knowledge, and I doubt you need to go any further than this in some CS class. Yes there are more intricate methods to run files as root whilst being user, but over and out.