Re: Gain root access on linux servers with physical access

Hello,
if boot loader are not password protected, that is enough.

For example: with lilo, a command like "lilo_prompt> init=/bin/sh" will give you a shell with root access... becouse you are telling kernel that /bin/bash is your init image.

Regards, Santiago.

spammailme@xxxxxxxxx wrote:
All -

I was wondering ideas on how to gain control of linux boxes with physical access to them in the hosting facility.

The owner has code on them yet never bothered monitoring or gaining root access and her developers are blackmailing her. She has access the the hosting facility and the servers and backup staff yet needs to regain control of the servers.

I asked what OS are they? She did not know. nmap cannot tell and p0f states:
# p0f
p0f - passive os fingerprinting utility, version 2.0.8
(C) M. Zalewski <lcamtuf@xxxxxxxx>, W. Stearns <wstearns@xxxxxxxxx>
p0f: listening (SYN) on 'eth0', 262 sigs (14 generic, cksum 0F1F5CA2), rule: 'all'.
x.x.122.x:54368 - Linux 2.6 (newer, 2) (up: 410 hrs)
-> x.114.33.x:80 (distance 0, link: ethernet/modem)

Any ideas how to get root with physical access? I remember in the past booting to a knoppix CD and messing with boot loader yet it has been a while.

Also the only ports open are 80 & 443.

Any ideas?



------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------



Relevant Pages

  • Fw: ERROR: /bin/insmod exited abnormally!
    ... Boot loader: lilo ... I'm running Redhat ES 3 release and after much struggle finally succeeded ... insmod QM_MODULES: ... Cannot open root device or unknown-block ...
    (Linux-Kernel)
  • Re: Read-only root (/) except /etc
    ... in the boot loader, use the kernel option ... where /pre-init.sh is executable by root and contains something like this: ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx ...
    (Debian-User)
  • Re: Root account desactivated
    ... Instant root shell. ... so securing the boot loader is a good idea. ...
    (Security-Basics)
  • Re: Problem with kernel image in a Prep Boot on PowerPC
    ... I can change the kernel root partition in the boot loader (root= ... the same package on x86 systems have the rdev command!). ...
    (Linux-Kernel)
  • Re: Restricting access to a web server by IP
    ... > remote control clients, etc - we remotely ... > The agrument against is that mpst vulnerabilities seem to come through ... > servers, and blocking access to all IPs accept those on the allowed list - ...
    (comp.security.misc)