ComputerSecurityStudent (CSS) [Login] [Join Now]


|UNIX >> CentOS >> CentOS-6.6 >> Current Page |Views: 21049

(CentOS 6.6: Lesson 5)

{ Using a Live CD to clear root's passwd in /etc/shadow }

Section 0. Background Information
  1. Background Information
    • In this lesson, you will learn how to use a Fedora Live CD or any Linux live CD to (1) boot into single user mode, (2) mount the "/" directory which contains /etc, and (3) how to remove root's password from the /etc/shadow file.

  2. Pre-requisites
    1. CentOS 6.6: Lesson 1: Installing CentOS 6.6
    2. CentOS 6.6: Lesson 2: Use CentOS 6.6 Grub to boot into single user mode
    3. CentOS 6.6: Lesson 3: Hardening the Boot Loader, /boot/grub/grub.conf
    4. CentOS 6.6: Lesson 4: Using a Live CD to crack a password protected grub.conf file

  3. Lab Notes
    • In this lab we will do the following:
      1. Boot the Operating System off a CentOS Live CD.
      2. We will mount the disk partition that contains /etc.
      3. We will delete root's encrypted password from /etc/shadow.
      4. We will test our handy work.

  4. Legal Disclaimer
    • As a condition of your use of this Web site, you warrant to computersecuritystudent.com that you will not use this Web site for any purpose that is unlawful or that is prohibited by these terms, conditions, and notices.
    • In accordance with UCC § 2-316, this product is provided with "no warranties, either express or implied." The information contained is provided "as-is", with "no guarantee of merchantability."
    • In addition, this is a teaching website that does not condone malicious behavior of any kind.
    • You are on notice, that continuing and/or using this lab outside your "own" test environment is considered malicious and is against the law.
    • © 2015 No content replication of any kind is allowed without express written permission.

 
Section 1. Configure CentOS-6.6 Virtual Machine Settings

  1. Open Your VMware Player
    • Instructions:
      1. On Your Host Computer, Go To
      2. Start --> All Program --> VMWare --> VMWare Player
     
  2. Edit CentOS-6.6 Virtual Machine Settings
    • Instructions:
      1. Highlight CentOS-6.6
      2. Click Edit virtual machine settings

     

  3. Set Machine to Boot From CD/DVD
    • Instructions:
      1. Select CD/DVD (IDE)
      2. Device status: Check the Connect at power on checkbox.
      3. Select the "Use ISO image file" radio button.
      4. Click the Browse Button and Navigate to the location of your CentOS-6.6-i386-bin-DVD1.iso or other Live CD.
      5. Click the OK Button

     

  4. Edit Network Adapter
    • Instructions:
      1. Highlight Network Adapter
      2. Select Bridged
      3. Click the OK Button

 

Section 2. Play Virtual Machine
  1. Start the CentOS-6.6 VM
    • Instructions:
      1. Click on the CentOS-6.6 VM
      2. Click on Play virtual machine
     
  2. Obtain Boot Menu
    • Instructions
      1. Once you see the below vmware screen, (1) Left Click in the screen and (2) press the "<Esc>" key
    • Note(FYI):
      1. This might take you a few times so be patient!!!
     
  3. Boot Menu Options
    • Instructions:
      1. Arrow Down to CD-ROM Drive
      2. Press <Enter>

     

  4. Rescue
    • Instructions:
      1. Arrow Down to "Rescue installed system"
      2. Press <Enter>

     

  5. Choose Language
    • Instructions:
      1. Arrow Down English or your language of choice
      2. Press the <Tab> key, which will move focus to the OK Button
      3. Press the <Enter> key

     

  6. Choose Keyboard Type
    • Instructions:
      1. Arrow Down to us or desired keyboard and press the <Tab> key
      2. Once the OK button is highlighted, press the <Enter> key

     

  7. Setup Networking
    • Instructions:
      1. Press the <Tab> key
      2. Once the No button is highlighted, press the <Enter> key

     

  8. Continue Mounting File Systems
    • Instructions:
      1. Press the <Tab> key
      2. Once the Continue button is highlighted, press the <Enter> key

     

  9. chroot information
    • Instructions:
      1. Press the <Enter> key

     

  10. Mount Information
    • Instructions:
      1. Press the <Enter> key

     

  11. Shell Access
    • Instructions:
      1. Make sure cursor is on "shell  Start shell"
      2. Press the <Tab> key
      3. Press the <Enter> key

 

Section 3. Examining Mounted File Systems in Single User Mode.
  1. Working in Single User Mode
    • Instructions:
      1. whoami
        • Notice you are the root user.
      2. df -k
        • Notice all the File Systems and Volume Groups are mounted on /mnt/sysimage
        • /mnt/sysimage is where CentOS mounts all the installation file systems and volume groups it discovers in the /etc/fstab.
    • Note(FYI):
      1. whoami, this command displays the user name associated with the current effective user ID.
      2. df -k, this command displays the amount of disk space available on each of the file systems.

     

  2. View the /mnt/sysimage contents
    • Instructions:
      1. cd /mnt/sysimage
      2. ls --file-type
        • Strings that end with a backslash(/) are directories, else it is a file.
    • Note(FYI):
      1. cd /mnt/sysimage, Change Directory to the /mnt/sysimage directory.
      2. ls --file-type, list directory contents and show the file type.

 

Section 4. Modifying /etc/shadow in Single User Mode.
  1. Make a backup copy of /etc/shadow
    • Instructions:
      1. cd /mnt/sysimage/etc/
      2. cp shadow shadow.bkp
      3. ls -l shadow*

     

  2. Open the shadow File
    • Instructions:
      1. vi shadow

     

  3. Position Cursor
    • Instructions:
      1. Cursor over one position to the right of the first colon(:)

     

  4. Delete Encrypted Password
    • Instructions:
      1. Type dt:
        • This will delete everything up to the next colon.
        • You should now see no password between the first and second colon(:).
    • Note(FYI):
      1. If you make a mistake, just press u to undo.

     

  5. Save the shadow file
    • Instructions:
      1. Type :wq!
      2. Press <Enter>

     

  6. Reboot Machine
    • Instructions:
      1. cd /
      2. poweroff

 

Section 5. Configure Virtual Settings
  1. Edit CentOS-6.6 Virtual Machine Settings
    • Instructions:
      1. Highlight CentOS-6.6
      2. Click Edit virtual machine settings
     
  2. Auto Detect Hard Drive
    • Instructions:
      1. Click on CD/DVD(IDE)
      2. Click the Use physical drive: radio button
      3. Make sure Auto detect is selected

     

  3. Edit Network Adapter
    • Instructions:
      1. Highlight Network Adapter
      2. Select Bridged
      3. Click the OK Button

 

Section 6. Login without a root password
  1. Start the CentOS-6.6 VM
    • Instructions:
      1. Click on the CentOS-6.6 VM
      2. Click on Play virtual machine

     

  2. Login to CentOS
    • Note(FYI):
      1. Until you click the user, in this case Security Student, the Password field will not be displayed.
    • Instructions:
      1. Click on Security Student
        • This will display the password text box.
      2. Supply its' password
      3. Click the Log In Button

     

  3. Open a Terminal
    • Instructions:
      1. Applications --> System Tools --> Terminal

     

  4. Switch User to root
    • Instructions:
      1. su - root
      2. whoami
    • Note(FYI):
      1. su, This is the switch user command.  In this case, I am switching from user student to user root.
      2. whoami, The command prints the user name associated with the current effective user ID.
      3. Notice you were not prompted for a root password!!!

     

  5. Switch User to root
    • Instructions:
      1. passwd root
      2. Provide a password
      3. Re-Enter the password

     

Section 7. Proof of Lab
  1. Proof of Lab
    • Instructions:
      1. egrep '(user root by|password changed for root)' /var/log/secure | tail -2
      2. grep root /etc/shadow* | awk -F: '{print $3}' | wc -c
      3. date
      4. echo "Your Name"
        • Put in your actual name in place of "Your Name"
        • e.g., echo "John Gray"
    • Note(FYI):
      1. egrep, is part of the grep utilities that allows you to search and filters files and string for pattern matches.  egrep provides additional functions, whereby you can search or filter many string using the pipe(|) as a string separator.
      2. grep, see the above note.
    • Proof of Lab Instructions
      1. Press the <Ctrl> and <Alt> key at the same time.
      2. Press the <PrtScn> key.
      3. Paste into a word document
      4. Upload to Moodle


Help ComputerSecurityStudent
pay for continued research,
resources & bandwidth