Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I got a box I am trying to pop (boot and root) that has an upload form on its website for logged in users that will take a .gzip file and extract it to the users home directory on the server. I am thinking that I might be able to exploit that does anybody know of a way to possibly make a .gzip file with malicious code maybe for a reverse shell?

share|improve this question
    
Question has the minty flavour of a possible blackhat question. May wish to reword the question or add context. –  LateralFractal Sep 17 '13 at 11:18
    
I do not wish to change the question at all if you read it you would see it was a boot and root box. –  Justin Sep 17 '13 at 20:09
    
Then the downvotes must be my imagination. –  LateralFractal Sep 17 '13 at 23:13
    
The fact that you don't know what a boot to root is kind of funny considering this is supposed to be a security site. I already figured it out on my own thanks and for your information the machine is called holynix look it up and educate yourself before you try and accuse people of having bad intentions. –  Justin Sep 18 '13 at 2:23
    
Thank you for the added context. "Holynix Penetration Test" clears up that this isn't a public website or stolen laptop being rooted. I am sorry if I assumed bad faith, but without context I had no way of knowing. "Boot and root" isn't that common a shorthand for a penetration VM. –  LateralFractal Sep 18 '13 at 6:08

1 Answer 1

You could create a gzip containing configuration files that you wish to overwrite, such as .ssh/authorized_keys if they are using public key authentication.

You might also be able to do some interesting things by overwriting .profile or .bashrc.

share|improve this answer
    
If the user has crontab privilege, the corrupted .profile or .bashrc could be used to set up a crontab schedule that polls for and executes an evil_instructions.sh from future gunzip actions. This way, providing the corrupted account has some way to talk to the outside world (user web content for example), an interactive session can be established over HTTP port 80 without requiring SSH firewall access. –  LateralFractal Sep 18 '13 at 6:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.