PT0-003 · Question #291
A penetration tester gains low-privilege shell access to a host and discovers a world-writable script that is run regularly as root. The tester runs the following command: openssl passwd password…
The correct answer is D. Change the 1001 entries to 0. The attacker's goal is to create an account entry in /etc/passwd that grants root privileges. In Unix/Linux, the UID and GID determine privileges; UID 0 is the root account. The line the tester appended sets UID/GID to 1001:1001, which does not grant root privileges. Changing…
Question
A penetration tester gains low-privilege shell access to a host and discovers a world-writable script that is run regularly as root. The tester runs the following command:
openssl passwd password $1$OjxLvZ85$Fdr51vn/Z4zXWsQR/Xrj. The tester then adds the following line to the world-writable script:
echo 'root2:$1$0jxLvZ85$Fdr51vn/Z4zXWsQR/Xrj .:
1001:1001:,,,:/root:/bin/bash">> /etc/passwd Which of the following should the penetration tester do to enable this exploit to work correctly?
Options
- AUse only a single redirect to /etc/password.
- BGenerate the password using md5sum.
- CLog in to the host using SSH.
- DChange the 1001 entries to 0.
How the community answered
(30 responses)- A10% (3)
- B3% (1)
- C3% (1)
- D83% (25)
Explanation
The attacker's goal is to create an account entry in /etc/passwd that grants root privileges. In Unix/Linux, the UID and GID determine privileges; UID 0 is the root account. The line the tester appended sets UID/GID to 1001:1001, which does not grant root privileges. Changing those numeric fields to 0:0 (UID 0, GID 0) will cause the new account to be treated as root when the entry is parsed by the system, enabling a root-level login with the supplied hash.
Topics
Community Discussion
No community discussion yet for this question.