Lab46 Wiki

User Tools

Site Tools

You are here: start » user » nbrimme1 » portfolio » break-into-linux
user:nbrimme1:portfolio:break-into-linux

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
user:nbrimme1:portfolio:break-into-linux [2019/02/13 00:44] – [Loop Device] nbrimme1user:nbrimme1:portfolio:break-into-linux [2019/02/22 00:44] (current) – [Method 2: boot to single-user mode] nbrimme1
Line 11: Line 11:
 =====Procedure===== =====Procedure=====
 ====Method 1: Using /sbin/init to execute a shell==== ====Method 1: Using /sbin/init to execute a shell====
 +[[https://en.wikipedia.org/wiki/Init|Init]] is a process started during bootup that initializes a system. It starts, stops and monitors essential service processes during bootup and shutdown. I will use it to execute a root shell after booting the target system.
   - Power on/reboot the target machine   - Power on/reboot the target machine
     - Through a graphical login screen: for a clean reboot just use the shutdown/reboot options in the system menu.     - Through a graphical login screen: for a clean reboot just use the shutdown/reboot options in the system menu.
Line 20: Line 21:
   - Continue booting.   - Continue booting.
  
-DONE! THAT'S ALL FOLKS!+DONE! THAT'S ALL FOLKS!\\
 After the target machine finishes booting, the kernel will detect the hardware and immediately drop you into a root shell. Since the system initialization script '/etc/rc.d/rc.sysinit' was bypassed and **NOT** executed,  After the target machine finishes booting, the kernel will detect the hardware and immediately drop you into a root shell. Since the system initialization script '/etc/rc.d/rc.sysinit' was bypassed and **NOT** executed, 
-we need to remount the root file system and make some changes to make the system more usable.: +you need to remount the root file system to make the system more usable: 
-  - Mount the /proc file system: <code:bash># mount /proc</code> You will see an error message complaining that it was already mounted. Ignore it.+  - Mount the /proc file system: <code:bash>mount /proc</code> You will see an error message complaining that it was already mounted. Ignore it.
   - Remount the root file system in read-write mode: <code:bash>mount -o remount,rw /</code>   - Remount the root file system in read-write mode: <code:bash>mount -o remount,rw /</code>
-  - Depending on how the target's file system is laid out, you may need to mount some other file systems. Lets view the file system table: <code:bash># cat /etc/fstab</code> Mount any other needed file systems (Like '/home', '/usr', etc.).+  - Depending on how the target's file system is laid out, you may need to mount some other file systems. Lets view the file system table: <code:bash>cat /etc/fstab</code> Mount any other needed file systems (Like '/home', '/usr', etc.).
   - Do whatever nefarious things you want:   - Do whatever nefarious things you want:
     - **Change the root account password:** <code:bash>passwd root</code>     - **Change the root account password:** <code:bash>passwd root</code>
-    - **PROTIP:** I don't recommend doing this as the next time the real user logs into the system they will notice that their root password has been changed. We need to be super sneaky, secretive, and surreptitious so here's something a little less noticeable:+    - **PROTIP:** I don't recommend doing this. The next time the real user logs into the system they will notice that the root password has been changed and it's **GAME OVER**. We need to be super sneaky, secretive, and surreptitious so here's something a little less noticeable:
       - Simply add another user without modifying the original root password: <code:bash>adduser -D -u 1000 bad-user       - Simply add another user without modifying the original root password: <code:bash>adduser -D -u 1000 bad-user
 passwd bad-user</code> passwd bad-user</code>
-      - Also add the newly created user to the sudoers file. This is also not as noticable as changing the actual root password: <code:bash>vi /etc/sudoers+      - Now add the newly created user to the sudoers file. This is also not as noticable as changing the actual root password: <code:bash>vi /etc/sudoers
 bad-user ALL=(ALL) ALL</code> bad-user ALL=(ALL) ALL</code>
-  - Reboot the target machine to make the changes persistent. First run 'sync' a few times to tell the kernel to flush any disk I/O out to the hardware and then 'umount' the mounted file systems in reverse order. +  - Reboot the target machine to make any changes to the file system persistent. 
-  - Once the file systems are all unmounted, you can reboot with either <Ctrl><Alt><Del> or the power switch.+    - Flush any disk I/O to the hardware: <code:bash>sync</code> 
 +    - Unmount any mounted file systems in reverse order: <code:bash>umount</code> 
 +  - Reboot with either <Ctrl><Alt><Del> or the power switch.
 ====Method 2: boot to single-user mode==== ====Method 2: boot to single-user mode====
 +[[https://en.wikipedia.org/wiki/Single_user_mode|Single user mode]] is a start-up mode that boots a multi-user operating system into single superuser. It is often used for diagnoses and triage of a broken or malware-infected system. After booting into single-user mode, a root shell is provided to the user.
   - Power on/reboot the target machine   - Power on/reboot the target machine
     - Through a graphical login screen: for a clean reboot just use the shutdown/reboot options in the system menu.     - Through a graphical login screen: for a clean reboot just use the shutdown/reboot options in the system menu.
Line 108: Line 112:
 # setup LUKS header # setup LUKS header
 cryptsetup -c aes-xts-plain64 --key-size 512 \ cryptsetup -c aes-xts-plain64 --key-size 512 \
- --hash sha512 --use-urandom \ + --hash sha512 --iter-time 5000 \ 
- luksFormat --type luks2 /dev/loop0+ --use-urandom luksFormat /dev/loop0
 # open file # open file
 cryptsetup open /dev/loop0 crypt cryptsetup open /dev/loop0 crypt
Line 131: Line 135:
 ====Entire Partition==== ====Entire Partition====
 **Note:** /dev/sdb1 will be used as the test partition, 'private' will be its name. **Note:** /dev/sdb1 will be used as the test partition, 'private' will be its name.
-<code:bash> +<code:bash># Create partition 
-## Create partition +
 cryptsetup -c aes-xts-plain64 \ cryptsetup -c aes-xts-plain64 \
  --key-size 512 --hash sha512 \  --key-size 512 --hash sha512 \
- --time 5000 --use-urandom /dev/sdb1 + --iter-time 5000 --use-urandom /dev/sdb1 
-## open volume onto device mapper+# open volume onto device mapper
 cryptsetup open /dev/sdb1 private cryptsetup open /dev/sdb1 private
-## create filesystem+# create filesystem
 mkfs.ext4 /dev/mapper/private mkfs.ext4 /dev/mapper/private
-## manually mount encrypted partition 
 # open mapped device # open mapped device
 cryptsetup --type luks open /dev/sdb1 private cryptsetup --type luks open /dev/sdb1 private
 # mount encrypted partition # mount encrypted partition
-mount -t ext4 /dev/mapper/encrypted /mnt/private+mount -t ext4 /dev/mapper/private /mnt/private 
 ... ...
-## manually unmount+ 
 +# unmount
 umount /dev/sdb1 umount /dev/sdb1
-# close the mapped device +# close mapped device 
-cryptsetup close private +cryptsetup close private</code>
-</code>+
  
 =====References===== =====References=====
user/nbrimme1/portfolio/break-into-linux.1550018697.txt.gz · Last modified: 2019/02/13 00:44 by nbrimme1

Page Tools

Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
CC Attribution-Share Alike 4.0 International Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki