Re: What if someone breaks into the root account and changes the root password?
- From: Bogwitch <Bogwitch@xxxxxxxxxxxxxxxxxxx>
- Date: Thu, 16 Aug 2007 21:34:58 GMT
Arrav wrote:
You call that advice?
Well, usually, if you have physical access to a computer, you can get root
easily (sometimes its a boot option in the bootloader), depends on the OS.
In Linux, you can just load safe mode, and you will get root without need
to type password.
Another way, is to boot up knoppix or some other boot cd, edit the
/etc/shadow file (or /etc/passwd on old systems) and change the root hash
with a know hash, just go to some website that offers md5 encryption,
encrypt your password, and replace the hashes. Then restart, take the live
cd disk out, and login with your new pass.
yet another way, is to search for some root exploit, that will grant you
the root account if your system is vulnerable. Check www.milw0rm.org and
SecurityFocus and PacketStorm for those. You can (hopefully) run the
exploit as a non-root user. When you are root, change the password
regularly. And final way - reinstall the OS ;-)
I think you'll find that the initial advice from Unruh would be better than the subsequent advice from Arrav. Yeah, sure, getting the root password reset would be a doddle. The problem comes from the fact that if the root password has been compromised, there is a very strong possibility that the intruder would have installed a rootkit, backdoor or other trojaned software. The only way to ensure you have a clean system would be to perform a clean install, restore from known good backups or to compare checksums of known good files to all the system files on the compromised system, check configuration files and any source code held on the system.
The chances are that a fresh install from known good media would be the easiest/ safest way to go forward.
You might want to take an image of the compromised system for a little investigation and analysis if it takes your fancy!
HTH,
Bogwitch.
.
- References:
- Prev by Date: Re: What if someone breaks into the root account and changes the root password?
- Next by Date: Re: What if someone breaks into the root account and changes the root password?
- Previous by thread: Re: What if someone breaks into the root account and changes the root password?
- Next by thread: Re: What if someone breaks into the root account and changes the root password?
- Index(es):
Relevant Pages
|
|
