Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Just gonna make this clear first, this is for class!

I have an assignment that requires to 1) modify a web server written in Java to accept file uploads and to use this to deface the homepage (did that no problem).

2) Take root ownership of the machine.

I'm hitting a bit of a wall with the second part. I used curl with an HTTP GET to traverse to the etc/passwd file but then later found that no passwords are stored here. I know the shadow file has the passwords stored, but I can't access it. The server kicks back a 404 when I try to, I'm assuming permissions are the issue.

My command for curl looks like this:

curl 127.0.0.1:8080/../../../../etc/passwd

Although I'm doing this from the same machine that the server is running on, I have to play it as if I don't have access to the server. Any help in pointing me in the right direction to go from here is appreciated!

share|improve this question

migrated from serverfault.com Jun 25 '13 at 16:40

This question came from our site for professional system and network administrators.

1  
Please review what is considered on-topic for SF. We do not provide assistance with system mis-use, regardless of context. –  Andrew B Jun 25 '13 at 16:33
    
But we do (only in certain context)! –  Lucas Kauffman Jun 25 '13 at 16:46
    
@LucasKauffman The question was migrated from SeverFault. I think the comment was in regards to what's OT there, not here on security. –  Xander Jun 25 '13 at 16:48
    
I know, I made them migrate it over here :p –  Lucas Kauffman Jun 25 '13 at 16:49
    
If you can use curl to get /etc/passwd, then I assume you can also read other file. E.g. ssh keys... –  Hennes Jun 25 '13 at 17:00
show 2 more comments

1 Answer

up vote 6 down vote accepted

There are different ways to go about this. First of all I would advice you to upload a shell onto the web server which allows for interactive bash commands. There are tons of them out there, not sure if there is one for java. If you don't find one just create a simple script which performs a reverse TCP shell bind to your IP (you can use netcat, if you aren't familiar with netcat lookup some tutorials).

From here you already have some easier control so you can go looking in files for interesting content. Check the logs for usernames/passwords and go looking for executables with the SUID bit set. Also try to find out what other services are running (these might be exploitable) so make a nice service enumeration. Make sure to check the version of the kernel when you are on there as it might be possible to create a local root exploit (check exploit-db and google).

share|improve this answer
    
Interesting, I'll take a look into these. Thanks! –  MGZero Jun 25 '13 at 17:01
    
You might want to watch this video too, it details a handful of InfoSec tools you might use for your assignment -> channel9.msdn.com/Events/TechEd/Europe/2013/ATC-B309 –  James Snell Jun 25 '13 at 20:43
    
I'm going to go ahead an accept this as the answer. I haven't been successful yet, however using scripts seems to so far be the best option. –  MGZero Jul 1 '13 at 18:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.