Ethical Hacking: Bypass Passwords with Linux PAM Degradation Attack
Source: YouTube · John Hammond · published Jun 13, 2023 · 21:46
This video demonstrates how to exploit a PAM (Pluggable Authentication Module) misconfiguration to escalate privileges on a Linux system from a regular user to root access 0:00-0:18.
Key Takeaways:
• After gaining initial access as a low-privilege user, enumeration reveals another user "Pamela" with world-readable home directory containing hints about a security hole 4:40-7:13
• Using LinPEAS scanning tool, the presenter discovers their user has ownership of a critical security directory containing PAM modules - a serious misconfiguration 13:36-16:07
• The exploit involves replacing pam_deny.so with pam_permit.so, effectively disabling password authentication and allowing access to any user account 17:56-18:36
• This manipulation enables switching to the Pamela account and then escalating to root without requiring passwords, granting full system access 18:46-19:24
This technique highlights how permission misconfigurations in authentication systems can lead to complete system compromise 19:25-19:43.
Sources:
- 0:00-0:18 Introduction to privilege escalation goals
- 4:40-7:13 Discovery of Pamela user and security hint
- 13:36-16:07 LinPEAS reveals critical PAM directory misconfiguration
- 17:56-18:36 Exploit technique: replacing pam_deny with pam_permit
- 18:46-19:24 Escalation to root without passwords
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
when an ethical hacker or a penetration tester or a red teamer compromises and gains initial access on a computer or a target one of their first goals is privilege escalation they want to become the administrator the root user the one with all the super power and can control anything on the Target in this video I want to show you one example of privilege escalation that can be done on Linux systems given there are some misconfigurations that we can learn how to look out for this is a capture the flag challenge to Showcase this technique it's actually one that I put together for the past nomcon event and by the way if you haven't registered for the nomcon 2023 Capture the Flag competition that is getting started just at the end of this week coming Thursday June 15th to June 17th this Saturd…