I'm doing a penetration test for a client who wants me to try and target a specific server. I have managed to get credentials(hard-coded in an in-house app) to a limited account on this server that works with sftp, but won't give a shell with SSH.

The message states that shells are only available when connecting from the opsware jumpbox.

I've tried looking at known_hosts, hosts, whatever config files I have permission to grab, and searching all through the DNS. I can't find a reference to it anywhere.

What are some other tips I could use to get the host of the "opsware jumpbox"?

  • What permissions does the limited account have? In particular, can you upload files? Where? – Gilles 'SO- stop being evil' Jul 28 '14 at 20:31
  • @Gilles I have write access to the users home directory and /tmp via sftp. I can't execute anything or set anything to execute. I can't get a shell of any sort except via a specific host, that I can't find via DNS or hosts files. – Sonny Ordell Jul 29 '14 at 21:00
  • Could you add a .crontab file in the home directory? It may give you a possibility to execute something. Or, see if there's anything useful in .bash_history, ... – ndrix Aug 3 '14 at 4:46
  • Closing because the question is essentially "how do I find a box I know nothing about or where it is?" Keep gathering info. – schroeder Mar 21 at 14:30