CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
Path: blob/master/documentation/modules/post/multi/gather/grub_creds.md
Views: 1904
Gather GRUB Passwords
Reads all passwords from GRUB configuration files on UNIX-like machines.
Vulnerable Application
Any UNIX-like system with a shell or meterpreter session using GRUB.
Verification Steps
Get a
shellormeterpretersession on some host.Do:
use post/multi/gather/grub_credsDo:
set SESSION [SESSION_ID], replacing[SESSION_ID]with the session number you wish to run this one.Do:
runIf the system has readable GRUB configuration files containing a password, they will be printed out.
Options
FILENAME
A string that can be used to specify an additional file to check after the usual places.
VERBOSE
A boolean that, when set, will provide more details on what is being checked. (Note: this option is defined elsewhere in metasploit, but this module can make use of it.)
Scenarios
There are many places where a user might place the password that GRUB uses, so inserting a password line into any of these locations will work without any additional configuration:
Using a Metasploitable 2 VM (running Ubuntu 8.04), you can add the line password topscret to /boot/grub/menu.lst to easily see this module in action.
Meterpreter
Typical run against Ubuntu 18.04 LTS