3

I am taking a Computer Security class and I am supposed to harden my system really well but I am supposed to leave one "hard backdoor" for the adversary to gain root access.

I have been trying to figure something out for two days now and as I am a total beginner, I still can't figure out what would be a good idea to do this.

I am running Ubuntu 14.04. Is there some backdoor a beginner like me can give the adversary to gain root?

Thanks in advance.

closed as too broad by schroeder, Xander, Mark, Stephane, Graham Hill Mar 31 '15 at 9:14

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • You could try Metasploit? securitytube.net/… – Marc Woodyard Mar 30 '15 at 21:17
  • 1
    Given recent developments, I'd be tempted to present a system with no normal back doors, and simply say they needed to intercept your hardware before it was delivered and install custom firmware that can be used for exploit purposes. If they complain, tell them it works for the NSA. – childofsoong Mar 30 '15 at 21:24
3

Backdoor for what? Future network exploitation or privilege escalation from the console?

why not put a password and a shell on some system account that nobody will notice -- for example change /etc/passwd:

from:

news:x:9:9:news:/var/spool/news:/usr/sbin/nologin

to:

news:x:9:9:news:/var/spool/news:/bin/bash

and sudo passwd news

Don't make news a sudo user (too obvious), but leave a cron job that runs with root privileges and is world writable (or just writable by news).

Another option is to add your public key to an admin's authorized_keys file.

now you need to run programs. one trick is to setuid on some random script you can write to.

another trick is to leave a program that cron executes as uid=root as world writable, and update that file to elevate your privileges.

0

What level is it aimed at? Beginner? How much have you been taught on the course?

Easy: Set up a listening netcat on port 4444 with a bash shell on it. (netcat -lvp 4444 -e /bin/bash) The way for the attacker to find this would be by using nmap to scan all the open ports.

Medium: Use a "known vulnerable" bit of software listening on a port. Older versions of some FTP programs are a good shout for this. Ability FTP Server 2.34 is probably the most commonly used for this reason, the exploit is easy to Google though once the attacker has enumerated the running services. (http://www.rapid7.com/db/modules/exploit/windows/ftp/ability_server_stor)

Medium-Hard: Host a vulnerable web application that allows you to inject code at some point for RCE or LFI/RFI. Or perhaps one where it's possible to read the database from carefully crafted request parameters, and then have an account that shares username/password between the entry in this database, and a user that can SSH.

Hard: Sky is the limit really. Check out some of the vulnerable by design ISOs on vulnhub to get ideas.

Not the answer you're looking for? Browse other questions tagged or ask your own question.