1

I have an old Beaglebone Black board which is similar to Raspberry Pi. Unfortunately, I forgot the Linux login password and can access the Linux using the Cloud9 feature. With this I can log into the Linux as a common user but cannot use any sudo commands.

enter image description here

In this situation, I can just wipe the microSD and reinstall the OS. But it might be a good chance to learn a penetration method. I can write C program and execute as a common user, then is it possible to execute a buffer overflow attack to reset my password?

Improve this question
15
  • 1
    How should we know that this is your board and not the computer of your ex girlfriends home server? Even if I would know how to attack this specific board I would not give out such information to complete strangers. – Sascha Jan 2 at 0:55
  • @Sascha I added a screenshot of my PC. You can see clearly from the IP address that the board is locally connected to the PC. – Nownuri Jan 2 at 1:57
  • 1
    Why wipe the SD card when you can just modify the password on it? – multithr3at3d Jan 2 at 5:04
  • 1
    @multithr3at3d Wow, he has physical access? I guess that should have been obvious given the local IP... Should be trivial then! Of course that solves his problem, but not his question (which seems to be about learning buffer overflow techniques). – forest Jan 2 at 5:08
  • 1
    @forest: giving security information is not the same as giving hacking instructions – Sascha Jan 2 at 11:59
2

I can write C program and execute as a common user, then is it possible to execute a buffer overflow attack to reset my password?

No, because by definition, any program you can write and run will run as you. Any buffer overflow would execute code as you, not as root.

You would want to overflow a setuid-root program, but without root privileges, you can't create one. Of the setuid-root programs already on the computer, you should not expect to be able to execute a buffer overflow against them; they're well vetted and secure.

Your best bet to get in is to interrupt the boot cycle and convince the boot loader to allow you to boot directly into a shell. Unfortunately, on specialized hardware, I've no idea how accessible GRUB or whatever boot loader is in use will be.

Update - ironically, in January 2021 a buffer overflow against one of those "well vetted and secure" system setuid binaries was announced - Baron Samedit. So while I still wouldn't expect to find a hole in one, perhaps you should feel free to try.

Improve this answer
5
  • I took the question to mean writing a C program that then attacks a privileged setuid executable. – forest Jan 2 at 4:00
  • @forest I read it the other way, but paragraph 2 covers your use case as well :) – gowenfawr Jan 2 at 4:06
  • Yup. Though I can't help but wonder if his interface doesn't give him some way to get root that he doesn't know about. I've never used cloud9. – forest Jan 2 at 4:08
  • In the generality in which it is given this answer is strongly misleading and potentially wrong (Depending on the kernel version and additionally installed daemons run as root). There are Overflow vulnerabilities in various versions of linux kernels. – Sascha Jan 2 at 12:10
  • 1
    @Sascha There are such vulnerabilities, but modern kernels, even outdated ones, will not be exploitable with only buffer overflows, which seems to be what OP is looking for. – forest Jan 3 at 3:40
2

You need to have root privileges to modify your password. This can be done by supplying the passwd utility with your user (non-root) password, since that utility is setuid and automatically runs itself as root no matter who executes it. If it verifies that the password you gave it matches the password on record for that user, it will allow you to change it by editing /etc/shadow for you.

There are many ways to get root on a system that you only have unprivileged local access to. This type of attack is termed local privilege escalation, or LPE. It usually relies on attacking a vulnerable setuid application, or attacking the kernel itself. Both of these require exploit development knowledge, which is not something someone can learn in one day, nor is it something that can be captured in a single answer here. If the system is running outdated software, you may be able to find a public vulnerability which you could use to elevate privileges. Otherwise, don't count on it.

As for using a buffer overflow exclusively, that's not going to work on any modern software. It might have worked in the 90s, but not today. There are numerous security techniques employed that make the naïve buffer overflow a thing of the past. Nowadays you need to bypass those techniques, which is not trivial. If you want to begin learning binary exploitation, start with a tutorial where you learn to exploit an intentionally insecure application with all the modern exploit mitigations manually disabled. Eventually you'll start learning how to perform the exploit even with mitigations in place (e.g. learning how to execute code in non-executable memory by leveraging ROP). This is the kind of thing you'll have to understand before exploiting a modern system with all the security in place.

Improve this answer
2
  • So, should there be a vulnerable application program that has been installed with root privilege? By the way, my question was specific to buffer overflow. If that does not work, then I would just wipe the microSD instead of learning all the complex methods. – Nownuri Jan 2 at 2:07
  • @Nownuri On a modern system, you won't be able to perform LPE with just a buffer overflow. – forest Jan 2 at 2:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.