Waraxe IT Security Portal

blaxenet · Active user

Hi Guys,

I have gotten myself onto a server that has /etc/passwd viewable, just wondering what my next step would be.

I've never quite understood this,
Fair enough you can upload a php shell such as C99 or R57.

You can have a fiddle around providing the permissions are set in your favour, go through config files and connect to the D/B's with the passwords.

But is there anything deeper?
Hence why I have asked what's next from /etc/passwd

Thanks everyone Smile

BlaxeNet

(I am learning how this works!)

waraxe · Site admin

If you have allready php scripting level and operating system shell level acces to server, then next try to find out operating system and kernel versions and then look for local root exploits. So next you upload that exploit's source code to server and will compile it, or upload allready precompiled exploit. Ultimate goal is to gain root access to server and install backdoor(s). And when you are root, then you can read "etc/shadow" file, so you have changes to crack root password - just for fun. Now, when you have "r00ted" that server, then you can install sniffer and spy network traffic on LAN. If the webserver is connected directly to corporative internal network, then you have possibilities to compromise lots of other computers, rip internal databases etc. But if webserver is located in DMZ, then this needs more work.

This was just one scenario. Rooting is considered as serious cybercrime, so I suggest to stay to low-privileges level Smile

pexli · Valuable expert

blaxenet · Active user

Hi Waraxe,

The system (Server 1) I was looking at doesn't have etc/shadow but rather a file called etc/master.passwd so I am presuming this is what I am looking for.

Needless to say, another system (Server 2) I was 'on' last night has etc/shadow so i'll have the chance to 'play' around a bit.

Just a quick rundown for you all-

**Server 1**
Software: Apache/2.2.2 (FreeBSD) mod_ssl/2.2.2 OpenSSL/0.9.7e-p1 DAV/2 PHP/4.4.2

**Server 2**
Software: Apache/2.2.2 (Fedora). PHP/5.1.6

On both of these I have the user 'www' access.

I'm not lazy so i'll do some research later and see how I go with the above recommendation(s) and see if I can advance any further.

Of course, I only want this info for what we call educational purposes Smile

Thanks for the info Waraxe!

BlaxeNet

waraxe · Site admin

For rooting it is important to know operating system kernel version.
In case of Linux you can use this: