Crack LinuxPPC Day 3:It Gets Better
So this ought to amuse ya: Its Day 3 of the Crack LinuxPPC, Win
PPC Contest that Jeff Carr has been doing. During that time, The
Win2k crack box has gone down several times... yet the LinuxPPC box
remains stable. Jeff has decided to make the game more interesting.
The machine is still crack.linuxppc.org, but the world now may know
that the Root Password is "linuxppc". If you can crack the stock
LinuxPPC box in a reproducable manner, you get the machine.
1:00pm - Tuned IIS' performance options reset application protection to Medium, and rebooted.
8:54am - Changed IIS' application protection to Low and rebooted, site back up
In other words, "Dragged slider bar in IIS window to a different setting, and waited five minutes while the system rebooted and restarted most of the services."
"Tuned" my ass.
Wah!
On most stock Linux installs you can't log
in directly as root remotely. You'd still
need to get at least a non-root shell somehow.
Basically he is just lowering the barrier of entry from "get a root shell" to "get a shell", but given the number of rootkits out for Linux, these are already pretty equivalent (penetrating a Linux box remotely is a lot harder than getting root once you are in).
"That's an application, not Windows 2000," he said.
"It's been up for most of the day today," he added.
Now that's comedy.
Ivan.
It's not that simple. You can't login as root over telnet/rlogin, ftp, etc. unless you specifically set that to be allowed (an obvious security hazard). Without a user account, it's harder, and some kind of exploit needs to be found. Having the root password only makes it easier once you have some sort of access to the system.