References . Chapter 1: Where to Start . Chapter 32: Management, Policy, and Pol

Question

References . Chapter 1: Where to Start . Chapter 32: Management, Policy, and Politics . Manpages for uname, marn UNIX history chart Lab Questions Use your login on Sleipnir to answer the uname and manpage questions. Read the section on policies for the policy questions 1. Name the exact OS (including version) running on Sleipnir. Use the Unix history chart (see link above) to briefly give the history of this OS 2. Execute 'man exec'. Which section was displayed by default? 3. What other sections contain the 'exec' keyword? 4. Which command would give you the manpage for the 5. What is the purpose of the MANPATH environmental 6. What is your current MANPATH on Sleipnir? Where is 7. Read the Acceptable Use Policy of the CS department. 8. Name two things you think should be in a policy 9. Can sysadmins be held legally responsible for what man command? variable? MANPATH set? Name an act that violates the AUP document for sysadmins occurs on their system?

Explanation / Answer

The goal of the challenge is to disclose the content of /root/secret.txt on server gotroot.hacking-lab.com. For that they have given the SSH credentials to connect to the server. But the given credentials are that of a limited user who has a restricted access.

From the initial information gathering process I found the following

As a trial and error method I started for all files which reside in that system. The command

provided me with following result and it shows that .bashrc file was writable. We know .bashrc stores information about the bash execution engine.

The next step is to execute the logout of command, Let the changes be applied to user and relogin. But it will not make fully unrestricted but we can access python, perl and C. Execute the shell using perl system command.

Which makes us free to use any commands.
Next target is get root on the system. Find all the files and its versions, which made me realise that the located glibc is outdated and vulnerable to Privilege Escalation vulnerability CVE-2010-3856. I searched for same kind of exploit code in the exploit-db.com. Found the code created a file in /tmp as its writable and executed the exploit code. That's called success, we got a shell with root. Now cat

Related Questions

Navigate

• Browse (All)
• Browse R
• Subjects

---

---

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.