3

When doing a PT, are we allowed to root servers to escalate privileges? I am planning for post exploitation and it necessary to root server for that. So it is better to stop there or go further.

  • As far as I know (I'm not a pentester), post exploitation doesn't specifically require root access. You could find sensitive data on the non-root user and exfiltrate them (obviously, only if the rules of engagement allow it!), and that would still be considered post-exploitation. – A. Darwin Jun 11 '16 at 17:57
  • 3
    This should be defined in the project scope. – user2320464 Jun 11 '16 at 18:10
  • 1
    What @user2320464 says, if you are claiming to be a professional pentester, you should have an agreement with your client that includes defined project scope. If you don't then, with all due respect, you don't deserve to call yourself a pentester, defined scopes are of critical importance for all sorts of reasons that you really ought to know about already. – Little Code Jun 11 '16 at 19:10
  • 1
    It's not often needed - once you have root, you could do pretty much anything on it. It's not good use of your time to demonstrate all the bad things that someone with unauthorised root access could do. You can provide some examples, but it's not unheard of for a pen test scope to say "in the event of a critical flaw, report immediately and the test will stop to allow this to be fixed". – Matthew Jun 11 '16 at 22:01
12

In a Penetration test,you can root a server if you are permitted to do. The question cannot have a generic answer. It can only be specific to a each case.

The Rules of Engagement specify whether or not you can root a server. A few things are considered for this:

  1. Is the server a Production one? If yes, then certainly you should restrain from rooting it.
  2. If its a Test server, you have to be consider whether rooting this server can be directly be used to compromise/sniff/etc any Production servers on same network. If so, then probably you should not root it.
  3. Businesses/Financial Impact that you may cause by rooting the server and post exploitation steps.
  4. Also, you have to consider the terms/agreements you have agreed to. Sometimes, there can be backlashes from management even if your intentions are good.

If you are not sure, better check with some person responsible for the servers (management).

Ultimately, post-exploitation does not require rooting a server, but is one option for performing the task.

  • 2
    Yes. I added a note to your answer about the Rules of Engagement, which should be in place before starting a pentest. – h4ckNinja Jun 11 '16 at 20:58
  • 2
    I will keep note of Rules of Engagemnet. Thank you – Nabin KC Jun 12 '16 at 10:01
2

In addition to the things said by Sravan, you should put in some effort to avoid doing anything to the server that's hard to reverse. Even though attackers are unlikely to stick to easily reversible actions, a company does not benefit from a prolonged downtime that stems from a poorly executed audit or test. There are already a number of horror stories out there that mention an auditor breaking the core business machines so hard that the company needs a week to recover because the auditor took out the backups at the same time.

So even if your RoE state that you can root a server, if the way you found to root a server would break it in a way that's not simply "restore from backup", like reflashing firmware or breaking hardware, you should not attempt doing so unless you have permission, either through the RoE or through an additional clarification request.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.