Everything, Everything

Look at the lovely view you can get from our London office's balcony! Sunny weather is not guaranteed. https://t.co/DogrRNtuJM
11 days, 10 hours, 40 minutes ago
It's so hot today that the temperature alert kicked in for one of my hard disks (warning, not critical). 14 emails in my inbox so far.
13 days, 10 hours, 44 minutes ago
Official launch of Windows Server 2016 will be at the Ignite conference (end of September) https://t.co/fx5346dO0w
18 days, 8 hours, 54 minutes ago
New version of Android is called Nougat. I think I'll stick to calling it Android N or 7. https://t.co/gyGYTKeSgR
28 days, 21 hours, 58 minutes ago
Tricking Nessus SSH Authentication
Saturday 11th June, 2016 18:35
She makes me nervous and makes me scared
But I feel so good if I just say the words
Su su (sudo su), just say the words
Oh, su su (sudo su), oh

With apologies to Phil Collins there, during a recent compliance check against an AIX host I had to configure Nessus to run the command "su su" to trick it into running "sudo su" in order to gain root privileges before it could successfully run its commands.

I'm not sure if this is the same issue someone else posted almost two years ago about sudo not working properly on AIX, but it seems that Nessus 6.7.0 tries to do the following when you configure it to use sudo (or su+sudo):
  1. Echo a string containing a random number.
  2. Run the actual audit command.
  3. Echo a string containing a different random number.
Unfortunately, based on looking at log files, it doesn't appear to surround all three commands with double quotes. This means that the first command, echoing a random string, is run using sudo. The next two commands then run normally under the current (low privileged) user. This fails and fills the compliance check output with lots of errors about files not existing, for example.

An elegant way to work around this is to create a symlink to sudo. For example:

ln -s /usr/bin/sudo /home/pentester/su

Then configure Nessus to use the method "su" and configure the "su" username as "su". Enter your own password again for the "su" user's password. Instead of using the default location for the su binary, point Nessus at your symlink, e.g. "/home/pentester". When the scan runs Nessus will run "/home/pentester/su su" which causes AIX to run "/usr/bin/sudo su".

Assuming your account requires a password in order to use sudo, AIX then prompts Nessus for a password. It'll supply what it thinks is the"su" user's password (which you probably don't even know) and your password elevates you to root.

From here Nessus runs all the commands properly, and your AIX 6.1 compliance results will hopefully contain a lot more passes instead of failures.
© Robert Nicholls 2002-2016
The views and opinions expressed on this site do not represent the views of my employer.
HTML5 / CSS3