Ssh

In this blog, I will demonstrate how a simple directory listing vulnerability led to full system compromise during a penetration test. Prologue “The best exploits are the ones that never feel like exploits at all.” — Mr. Robot I discovered that a web server was exposing its directory contents. Several configuration and compressed files were visible, indicating possible sensitive information leakage. Source Code Analysis After downloading and analyzing the exposed files, I found a PHP configuration file containing PostgreSQL database credentials. ...

Initial Entry Point During a routine exploration of vulnerable servers on the internet, I successfully gained root access to several machines. While the specific method used to achieve root access is beyond the scope of this blog, I’ll focus on how I expanded my access to other servers within the same organization. Extracting Linux User Hashes Once inside the compromised machine, I noticed multiple user accounts. With root privileges, I accessed the /etc/shadow file, which stores password hashes for all users on the system. I copied the contents of the shadow file to my local machine and extracted the hashes using the following command: ...

Discovery of Vulnerable Machines While investigating vulnerable, internet-facing systems, I successfully compromised several devices. Although the specific techniques I used to gain initial access fall outside the scope of this post, the real discovery came during my post-exploitation phase on one of the compromised machines. Discovering Vulnerable SSH Configurations While reviewing the files on the compromised system, I stumbled upon something interesting in the ~/.ssh directory of a particular user account. Within this directory, I found a private key file being used for SSH logins to other systems. My next step was to check whether the private key was encrypted. ...

SSH Services at IIT Kanpur IIT Kanpur’s network uses Class B private IP addresses. Within this private network, students, faculty and staff can SSH into various servers using their Computer Center credentials to access different services. Examples of such servers include the GPU server, APP server, and MATH server. Each user has a 2GB directory on the Computer Center’s NFS (Network File System), which is mounted on all servers. This allows users to access their files across multiple servers without needing to copy them to each one, reducing the need for additional storage on individual servers. ...