I am a security auditor and I have faced the following situation:

A development company that has a group of Linux machines gives limited access to their users. They asked me to find out all the possibilities where the user can gain root access to the machine. With the BIOS not secured I know that their policy is vulnerable and users can get root access using live CD then modifying the root password from /etc/shadow without them noticing; but I need all other tricks that can give users root access to their laptops.

Is there other possible stealth ways to gain root access ??


There's a myriad of ways, depending on the system configuration and installed software. Learn what you can about the system, and then look for publicly-known "privilege escalation" vulnerabilities in the OS and installed software. Make sure to check for the specific versions that are installed, as most known vulnerabilities will likely have been patched in the latest versions.

Depending on the scope and rules of engagement for your test, you could also try to trick System Administrators into installing keyloggers onto their own systems and capture the root password that way. Or, just dump the shadow file and run it through a cracking utility - if you're lucky, they're using a weak enough root password that you can break it in a reasonable amount of time and elevate yourself that way.

If you have the shadow file, believe it or not, Google can also be a useful resource. Drop the password hash into a Google search and see if anyone's posted the matching cleartext online.

Also be aware that BIOS policy alone is not enough. BIOS settings can often be reset through trivial means, or you could remove the hard drive from the system and attach it to your own computer for full access. Whole-disk encryption is the only effective countermeasure against this, but if you're assuming the attacker is an authorized user of the system, then the attacker also has the keys to decrypt the drive on a separate system with the right software.

Not the answer you're looking for? Browse other questions tagged or ask your own question.