Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add check to detect OS (Debian) where su-bruteforce cannot be used #6

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

leoCottret
Copy link

@leoCottret leoCottret commented Feb 20, 2024

Hello, I noticed during a CTF that su-bruteforce didn't work for some reason.
After digging a bit, it's because of the OS.
su from Debian will not authorize the use of su without a terminal
image
I found the relevant code here:
https://sources.debian.org/src/shadow/1:4.5-1.1/src/su.c/?hl=720#L720
I think this problem is still relevant
https://sources.debian.org/src/shadow/1%3A4.8.1-1/src/su.c/#L721

Since the current code discard the stderr, the current behavior is a false negative.

  trysu=`echo "$PASSWORDTRY" | timeout $TIMEOUTPROC su $USER -c whoami 2>/dev/null` 
  if [ "$trysu" ]; then
    echo "  You can login as $USER using password: $PASSWORDTRY" | sed "s,.*,${C}[1;31;103m&${C}[0m,"
    exit 0;
  fi

So I added a check, a message and stop the script in case it can't be used against this type of OS

PS: the relevant CTF
https://tryhackme.com/room/jackofalltrades
Debian 3.16.7

EDIT:
I noticed that linpeas already contains a check to see if su exists: peass-ng/PEASS-ng#363
and a check on the "must be run from a terminal" that already existed

So I ported them instead.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant