Administrace komentářů

ahoj, neptejte se proč, ale přepsáním libc6 knihoven se stalo, že po restartu systému nenaběhlo SSH. Teď se snažíme na "routr" dostat. Bohužel, router je na stořáru od antény a není přístupný.

potřčebuji smazat 3 soubory a původní "soubory.bak" přejmenovat aby vše zase chodilo.

SSH nenaběhne, na routeru jede jenom quagga (routovaci deamon) do kterého se dostanu telnetem

sea:~# telnet router 2601
Trying router...
Connected to router.
Escape character is '^]'.

Hello, this is quagga (version 0.96.4).
Copyright 1996-2002 Kunihiro Ishiguro.


User Access Verification

Password:
dwarf>
     

a na co se ptám?

Jak pomocí quaggy nějakým trikem získat shell? root heslo cílového routeru znám. Přemýšlím, zda nějak nejde třeba pustit /bin/sh a pod.

Nenapadá vás něco?

dík za jakýkoliv nápad..

Starting Nmap 4.03 ( http://www.insecure.org/nmap/ ) at 2006-11-19 13:28 CET
Interesting ports on router:
(The 1671 ports scanned but not shown below are in state: closed)
PORT     STATE SERVICE
22/tcp   open  ssh
2601/tcp open  zebra
2604/tcp open  ospfd

Nmap finished: 1 IP address (1 host up) scanned in 13.003 seconds

a takto se chova ssh

sea:~# ssh -v router
OpenSSH_3.8.1p1 Debian-8.sarge.4, OpenSSL 0.9.7e 25 Oct 2004
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to router port 22.
debug1: Connection established.
debug1: identity file /root/.ssh/identity type -1
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_3.4p1 Debian 1:3.4p1-1.woody.3
debug1: match: OpenSSH_3.4p1 Debian 1:3.4p1-1.woody.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.8.1p1 Debian-8.sarge.4
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'router' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:32
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
Connection closed by router