I am facing a problem with a system administrator that does not think it is necessary to update his systems anymore. His main server (which holds the home directories of a lot of users) is running
(/etc/issue.net) with Kernel
Linux SERVER 220.127.116.11-0.5-default #1 SMP 2009-08-14 01:48:11 +0200 x86_64 x86_64 x86_64 GNU/Linux
I wanted to proof to him that breaking into a system that old is easy, but hit a brick wall - most of the Local Privilege Escalation exploits I found either do not work on that version anymore (too old) or not yet (too young, kernel version does not yet include the vulnerable feature).
I have a non-privileged user account on his systems, but ideally I would like to be able to show our boss an exploit that someone without a local account could use over the network to break into the system.
Anticipating all the answers saying "I will not help you hack a system": This is happening inside a public institution, nothing here moves without a reason. People cant be terminated unless there is unsurmountable evidence of their wrongdoing.
One more taste of why I want things to change: A printer job has been running on the machine for more than a year now - the printer it is trying to reach has been replaced a couple of months ago. This task now consumes 99% CPU permanently, trying to reach what is not there any longer. Imagine the electricity bill this has racked up, for NOTHING.
As far as I can see, the server is currently running the following services on the network:
- mysql Ver 14.12 Distrib 5.0.51a
- CVS Concurrent Versions System (CVS) 1.12.12
- OpenLDAP 2.4.9 (Jul 7 2010 10:16:11)
- Kerberos 5 release 1.6.3
- OpenSSH_5.0p1, OpenSSL 0.9.8g 19 Oct 2007
- SMBd Version 3.2.4-4.12-2373-SUSE-SL11.0
Update on the Situation: This is a file server for a university institute. It is not reachable from the entire university network, but only from the chairs network. Problem: TAs and other students that write their thesis or help with teaching also have physical access to this "internal" network. Most of the users know better than to store critical data such as exams on this server, but there is the unacceptable risk of students accessing this machine and gaining access to documents that they should not have access to - which is what I want to proof.