1

I want to write a script that allows me to pass a password to the su command. The reason for this is to automate the process of logging into root from nonroot account. From my basic understanding of security, I know the dangers of this. I still need this to try to crack the root user password by reading passwords from a file.

I have heard about using the expect command to automate interactions but I do not know how it works, or if it is applicable in this situation. Any information about using expect would be greatly appreciated.

Please note that sudo is not an option as my user is not on the sudoer list.

Things I've tried - Passing the password in using pipes Didn't work because of "su must be used from terminal" type error - Passing the password using echo Whatever was echoed would simply show up after the password was entered

  • 1
    Depending on the OS you might be able to reboot into single user mode and reset the root password. Otherwise, reboot from a live distribution, mount the local installed OS and reset the root password. – Lambert Jan 6 '16 at 9:54
  • what about echo "passwd" | sudo -S your_command? – Pandya Jan 6 '16 at 10:10
  • @Pandya Generally yes, though the OP did say "Please note that sudo is not an option as my user is not on the sudoer list." . :) – Malte Skoruppa Jan 6 '16 at 10:13
  • 1
    So, you want us to help you break into somebody else's system? – terdon Jan 6 '16 at 10:31
  • 1
    @MalteSkoruppa none whatsoever. I was hoping the OP would give a benign reason to do this to assuage my fears of wrongdoing. – terdon Jan 6 '16 at 14:15
1

Doing this "oneline style"

expect -c 'spawn su - ;expect Password:;send "your-password\n";interact'

Take a look at the output of su - to guarantee if this is the right phrase that appears to capture a password. I'm using a translated version of Linux here so, the word would be "Senha:" instead of "Password:".

  • expect -c '': Run the following actions to this command
  • spawn su -: Execute this command
  • expect Password: Expect the word password to do something
  • send "your-password\n": Type in your password, followed by an Enter
  • interact: Keep interaction ready to the command.
  • This worked. Thank you very much for the clear dissection of the commands. – HyperSphere Jan 6 '16 at 17:47
  • Ok, I understand why this is not working. My non-root user is not on the sudoer list. Is there a way to add him to the list? If not, is there another way to have the user attempt to login as root without requiring any special permissions? – HyperSphere Jan 26 '16 at 8:21
  • If you have the root password, you can use su - to get a root shell. To add people to the sudoers list, you will need to first access the system as root and execute the visudo command to grant some privileges that will require(or not) a password. It would be a system failure if you could get root access whenever you want(and without using exploits/bugs), dont you think? – user34720 Jan 26 '16 at 10:02
1

You can use expect to do that job for you. Save the following to a file, make it executable, and run it:

#!/usr/bin/expect
spawn su
expect "Password:"
send "YOUR_PASS\n"
interact

(Obviously, you need to specify the correct path to expect. Here I used /usr/bin/expect as an example.)

If YOUR_PASS is the correct root password, you should now have a root shell. If not, you get an authentication failure.

Note that the interact command will probably not be needed in the context of a fully automated script, as it gives control of the process to the user, i.e., keystrokes are sent to the current process and stderr and stderr are returned.

See man expect for a more detailed description of the commands spawn, expect, send and interact, and many other commands.

  • Thank you, great help. Quick question though, why does the answer above not require the specification of a file directory for expect and this one does? – HyperSphere Jan 6 '16 at 17:49
  • @HyperSphere This is an executable script, and the kernel needs to need what interpreter it should use in order to execute it. This is why it begins with the Shebang #!, followed by the path to the interpreter. The other answer executes the command expect in the context of a shell, such as bash. If no path is given, the shell will look for an executable named expect in all directories specified in the environment variable $PATH, and execute the first it finds with the given arguments. – Malte Skoruppa Jan 7 '16 at 1:47
  • The two answers are actually pretty much the same, only written in a slightly different way. Both allow you to execute the expect script in the context of a larger shell script: Either by calling the expect script above, or by using the one-liner from the other answer. Both are fine. A self-contained expect script is probably better for more complex scripts, while the one-liner is easier for simple scripts. – Malte Skoruppa Jan 7 '16 at 1:59
  • Ok, I understand why this is not working. My non-root user is not on the sudoer list. Is there a way to add him to the list? If not, is there another way to have the user attempt to login as root without requiring any special permissions? – HyperSphere Jan 26 '16 at 8:21
  • What exactly "is not working" for you? In the above script, su is used to attempt to login as root; no special privileges are needed to do that, save the root password (in particular, you do not need to be in the sudoers list, which is only relevant for the sudo command.) If you could just add yourself to the sudoers list, then you could also just make yourself root without the root password. – Malte Skoruppa Jan 26 '16 at 11:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.