# \[TUTORIAL\] Hacking Into Linux (Newbie Series)

**URL:** <https://onehack.st/t/tutorial-hacking-into-linux-newbie-series/3523>\
**Category:** Tutorials & Methods\
**Tags:** hacking, tips-tricks\
**Created:** [December 18, 2017, 7:44pm UTC](https://onehack.st/t/tutorial-hacking-into-linux-newbie-series/3523 "2017-12-18T19:44:56Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![NoBody](https://onehack.st/user_avatar/onehack.st/nobody/32/163880_2.png) [@NoBody](https://onehack.st/u/NoBody)\
**Post date:** [December 18, 2017, 7:44pm UTC](https://onehack.st/t/tutorial-hacking-into-linux-newbie-series/3523/1 "2017-12-18T19:44:56Z")

</div>

* * *

Hacking into Linux (NEWBIE SERIES)

* * *

Till now almost all Hacking Truths manuals have been Windows centric. I have always  
kept the newbie Windows user in mind, while writing manuals. However, with the  
growing popularity of Linux and the fact that Linux is considered to be the Hacker’s OS,  
I decided to start a \*nix series.

## Getting Root on a Linux machine

As you read this manual, you will discover that our basic aim always remains the same,  
i.e. we want to get root. Now, root is nothing but sort of a sort user, who has maximum  
privileges, and can do whatever he wants to do on a system. ‘Root’ is to \*nix what  
administrator is to Windows NT. If you get root then you can practically control each and  
every aspect of the system. You could, remove accounts, delete files, disable daemons,  
and even format the entire system.

* * *

**NEWBIE NOTE** : Getting root is considered to be really really elite especially in schools.  
If you are able to get root in your school network, then you practically get transformed  
into a semi-god, but why? Well, the reasons are pretty obvious. Aren’t they?

* * *

OK, I am really interested. How do I do it? Well, in this section, we are not going to run  
any C program nor are we going to do any kind of coding, but we will simply exploit a  
small vulnerability existing in a feature which comes with Linux. This will work almost 9  
times out of 10, however, if you plan to use this technique to get ‘root’ on your ISP, then  
forget it pal. The technique explained below is quite common and the system  
administrator would probably be smart enough to cover up this security loophole.  
Before we move on, there is one thing that you need to keep in mind. i.e. For this to  
work, you need to have physical access to the target system. Anyway, boot the target  
system and wait for the LInux LOader or LILO Prompt to come up.

At the LILO prompt type ‘linux single’ (without Quotes) or ‘linux 1’ to get the root shell  
where you can practically do anything.

Once Linux single is running, you get the root shell where you can type can any  
command which is accepted by the default shell on your system. Now, here, type  
‘linuxconf’. This will bring up a blue screen, which is the Linux Configuration Utility.  
Then, click on Users \> Root Password. This will allow you to change the root  
password!!! Yes, you read right, change the root password. Scroll down further, and you  
could also add new accounts with root privileges.

The linux config utility is certainly not a hole in Linux. It was actually designed to help,  
if the root password was forgotten.

Well, there is yet another way in which we can get root. In the first method, we typed  
‘linuxconf’ in the bash shell prompt, however, we could type the following to create a  
new account with root privileges and without any password:

echo “ankit::0:0:::” \>\> /etc/passwd

This command will basically edit the /etc/passwd file which is the password file which  
stores the Passwords and Usernames of all accounts on the machine. One thing to  
remember here is that you can edit the /etc/passwd file only if you are logged in as root,  
however, in this case we are not logged in as root, but we have booted into linux single  
which gives us the root shell. Hence, we can still edit it.

Anyway, to understand how exactly the above command works and how it is able to  
create a new account without a password, we need to learn the /etc/passwd file is  
structured.  
The following is a line from a password file:

ankit:my\_password:2:3:Ankit Fadia:/home/ankit:/bin/bash

The above can in turn be broken up into:

Username: Any

Encrypted Password: my\_password

User number: 2

Group Number: 3

Actual Name: Anyname (Optional)

Home Directory: /home/ankit (Optional)

Type of Shell: /bin/bash (Optional)

In our command, we have not included the optional fields and the password field of a  
typical password file line. Our command:

echo “ankit::0:0:::” \>\> /etc/passwd

can be rewritten as:

Username: ankit

Encrypted Password:  
User number: 0

Group Number: 0

Actual Name:

Home Directory:

Type of Shell:

This basically creates a new account with root privileges, which can be used as a  
Backdoor into the system.

* * *

HACKING TRUTH: If you have enabled, shadow passwords, then the command will  
change to:

echo “ankit::0:0:::” \>\> /etc/shadow

A typical line from the password file on a system with Shadow Passwords enabled is as  
follows:

ankit:\*:2:3:Ankit Fadia:/home/ankit:/bin/bash

In a shadowed password file what happens is that the password field is replaced by a ’ \* ’  
(The ’ \* ’ is called a token.) such that the encrypted password does not show up in the  
password file and the list of encrypted passwords is stored in a different file which is not  
readable by normal users.

* * *

I have tired the above method on a number of systems, and have found that it works only  
about 80% of the times. So, after some more fooling around, I came about with yet  
another method, which till now seems to be foolproof.

Now, as you are in the root shell, launch your favorite editor (eg vi) and open /etc/passwd  
in it. Now, delete the encrypted text between the first two colons in the line, which  
contains the entry for root. This, will not create a new account with root privileges, but  
will change the password of the root, to null. So, basically this will get you a root account  
without any password. Once, you have removed the encrypted password, at the prompt,  
type ‘init 3’ to switch back to the normal start up or else for a graphical start up type: ‘  
init 5’.

Now, say you do not want to create a new account, but want to change the root password  
so as to teach the system administrator a lesson. What do you do? Well, simply use the  
passwd command followed by the new password. As you are in the root shell, the root  
password will change to the new one that you supply.

OK, I get the point; Linux too is not 100% safe, so how can I make it safer? Well, you  
could password protect linux single. To do so, you have to launch your favorite editor  
like vi, and open /etc/LILO.conf. Now, add the following line, in a new line, after the first  
line:

Restricted password\_goes\_here

(The above is: Restricted followed by a space and following by the password that you  
choose.)

Now, save and close the editor. At the prompt then type: LILO, to execute the  
/etc/LILO.conf file, so as to make the changes. Now, the next time, you type linux  
single, at the LILO prompt, you will be asked the password that you typed in the above  
file. So this basically acts as another barrier for anyone trying to use the techniques  
described in this manual, to break into your Linux box. None, of the other functioning of  
the linux box will be affected.

* * *

HACKING TRUTH: Well, Aragon (veljkop@ptt.yu ) suggested yet another method,  
which I would like to mention.

1.Go to directory /etc/rc.d

1. In it there should be several files if your lucky there are a bunch of files with similar  
names rc.1,rc.2…etc. these files are shell scripts which are run each time when the named  
runnlevel is started. These files are very much similar to autoexec.bat but even more  
complex you can mess with them to cause interesting results BUT be CAREFULL!). rc.1  
is therefore the file for runlevel one

3.Backup it in a file named rc.x (or something else)

4.Copy some other runlevel (runlevel 3 is good) but make sure that the runlevel is multi-  
user.

5.Make a boot and root(for Slackware) disc (do not skip this) so if anything goes wrong  
you still have an runlevel 1

## Getting root Remotely:

The following has been taken from Bugtraq, this exploit is supposed to get you root.  
However, it has not been tested or verified by me. To be continue…

Continue reading next description including buffers, codes, roots at .txt file available below.  
[Download.txt (Zippyshare)](http://www74.zippyshare.com/v/0DMTB7pm/file.html)  
[Download .txt (Mega.nz)](https://mega.nz/#!7gc0TYaR!rwSqygveM6iz8UAMwtjKeyEwInfXB4kSMV853fgY6Eg)

**DISCLAIMER** : _Due to limited letters i cannot keep above description & coding at thread. so this is why i have attached .txt file for you to continue reading where it ends at thread. Regards!_ 🙂