full-disclosure - Root password change

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <442C570A.7040104@kallisti.se>
Date: Thu Mar 30 23:09:27 2006
From: hdw at kallisti.se (Anders B Jansson)
Subject: Root password change

Michael Holstein wrote:
>> Isn't it easier to boot into single user mode and reset the password? It
>> doesn't require you to load the live CD which is one less step.
> 
> 
> depends on if they setup 'console' as insecure or not in /etc/ttys.

Setuid script on /tmp?
Given that /tmp isn't mounted with correct flags of course,

And given that you're really the legitimate root on the machine.
Otherwise it's social engineering and race conditions.

But for a legitimate root, just boot -s on a cd, mount the / of the boot disk in rw and change the pw.

And if you're not the legitimate root, do you really expect us to tell you how?

White hats won't beacause it's wrong, black hats wont's because it's not funny, and gray hats won't because it's not intresting.

-- 
// hdw