You have access to the vim text editor via sudo, but shell escapes are blocked. How do you escalate privileges to get an unfettered root shell without sudo?

#Linux #DFIR #CommandLine #Trivia

@hal_pomeranz Edit /etc/sudoers?
@piquant00
I have a similar issue in an old pc. Can't find the password for sudo.
Can't update Linux, can't even reinstall it since I can't boot from the USB pretty crazy
#linuxhelp
@hal_pomeranz
@away2thestars @piquant00 https://linoxide.com/boot-root-shell-prompting-password/ - Once you are at the root prompt, edit /etc/shadow and remove the password hash for the root account. Reboot the system normally and you will be able to log in as root without entering a password.
How to Boot into Root Shell without Password

How to boot into root shell in linux without entering the password. Command line root recovery by entering in single user mode for maintenance.

LinOxide

@hal_pomeranz @away2thestars @mastodon.gamedev.place @piquant00

Not quite the same, but similar - at a former role working in an IA lab, while rotating root password on Solaris 10, we fat fingered the new phrase twice and got locked out of root.

I was able to use the low level OS on the Sun box to find the proper sector where the OS partition was and then mount it to boot into single user mode.

From there we edited the shadow file and cleared out the root password hash, saved, then shutdown single user mode and booted back into the proper OS, then sudo'd to root with no password, then changed the password using passwd.

That was a lot of fun.

@crash0ver1d3 @away2thestars @piquant00 Then there was that time in the early 90’s when I had to walk a graveyard shift operator through editing the fstab using “ed”. File got corrupted and /usr wouldn’t mount. So we had old school Unix /sbin only— “ed” but no “vi”.
@hal_pomeranz @piquant00 how can I get the root prompt though since there isnt/haven't got passwd to root 🥲
@away2thestars @piquant00 Just enter "root" as your username to log in, or if you're logged in as a regular user just use "su".
@hal_pomeranz
I wrote su->entered password ->authentication failure
@piquant00
@away2thestars If you properly removed the password hash for the root account in /etc/shadow you should not even be prompted for a password.
@hal_pomeranz
I can see a shadow file I can't edit it since I'm not root
@away2thestars Oh I understand now. You need to reboot your system (power it off and on if necessary) and follow the advice in the original article I linked to. You will boot into a bash shell running as root and can edit /etc/shadow from there.

@away2thestars @hal_pomeranz

"su" doesn't work on *buntu which has the root account disabled by default.