1

I am facing a problem with a system administrator that does not think it is necessary to update his systems anymore. His main server (which holds the home directories of a lot of users) is running

openSUSE 11.0

(/etc/issue.net) with Kernel

Linux SERVER 2.6.25.20-0.5-default #1 SMP 2009-08-14 01:48:11 +0200 x86_64 x86_64 x86_64 GNU/Linux

(uname -a).

I wanted to proof to him that breaking into a system that old is easy, but hit a brick wall - most of the Local Privilege Escalation exploits I found either do not work on that version anymore (too old) or not yet (too young, kernel version does not yet include the vulnerable feature).

I have a non-privileged user account on his systems, but ideally I would like to be able to show our boss an exploit that someone without a local account could use over the network to break into the system.

Anticipating all the answers saying "I will not help you hack a system": This is happening inside a public institution, nothing here moves without a reason. People cant be terminated unless there is unsurmountable evidence of their wrongdoing.

One more taste of why I want things to change: A printer job has been running on the machine for more than a year now - the printer it is trying to reach has been replaced a couple of months ago. This task now consumes 99% CPU permanently, trying to reach what is not there any longer. Imagine the electricity bill this has racked up, for NOTHING.

As far as I can see, the server is currently running the following services on the network:

  • mysql Ver 14.12 Distrib 5.0.51a
  • CVS Concurrent Versions System (CVS) 1.12.12
  • OpenLDAP 2.4.9 (Jul 7 2010 10:16:11)
  • Kerberos 5 release 1.6.3
  • OpenSSH_5.0p1, OpenSSL 0.9.8g 19 Oct 2007
  • SMBd Version 3.2.4-4.12-2373-SUSE-SL11.0

Update on the Situation: This is a file server for a university institute. It is not reachable from the entire university network, but only from the chairs network. Problem: TAs and other students that write their thesis or help with teaching also have physical access to this "internal" network. Most of the users know better than to store critical data such as exams on this server, but there is the unacceptable risk of students accessing this machine and gaining access to documents that they should not have access to - which is what I want to proof.

closed as too broad by Polynomial, DKNUCKLES, Steffen Ullrich, Bacon Brad, Xiong Chiamiov Sep 21 '17 at 23:42

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    You have a lot of info to start there - start by looking for CVEs for all of the services you list. Tools like metasploit probably have exploits for them. Obligatory warning though, attacking a system without consent of the owner will almost certainly constitute gross misconduct and a criminal offence. If you are concerned you should check internal policies to see if you can raise these issues properly and legally. – iainpb Sep 21 '17 at 15:32
  • 1
    Nothing is fully secure. The question is instead if the risk is acceptable. This not only depends on the vulnerabilities of the machine but also its task, who has access, the possible damage when hacked etc. Thus, it might be considered secure enough or there might simply be more important problems than fixing this one. Or fixing might be critical but nobody is aware of this. Who knows and there is not enough context about this in your question. – Steffen Ullrich Sep 21 '17 at 15:47
  • 1
    So your plan is to look for privilege escalation bugs to prove your point? There are any number of privesc kernel bugs (dirty cow comes to mind) that renders the target extremely unstable. If you cause downtime to prove your point you'd better start sprucing up your resume. There has to be a better way to prove your point. – DKNUCKLES Sep 21 '17 at 15:47
  • 1
    Ask your boss for permission to do this first - or else you'll likely be disciplined. They may also prefer that you spend your time on other tasks that are actually your job. – Xiong Chiamiov Sep 21 '17 at 23:44
  • 1
    @ThE_-_BliZZarD: Based on your updated information I find the system relevant. But I don't think that you should try any exploits on this live system. If you feel that you need to proof something build yourself a system with the same software versions and proof that you can exploit this. And then you could also try Metasploit since no harm will be done against production system. – Steffen Ullrich Sep 22 '17 at 9:35

Browse other questions tagged or ask your own question.