2

I want to write a script that allows me to pass a password to the su command. The reason for this is to automate the process of logging into root from nonroot account. From my basic understanding of security, I know the dangers of this. I still need this to try to crack the root user password by reading passwords from a file.

I have heard about using the expect command to automate interactions but I do not know how it works, or if it is applicable in this situation. Any information about using expect would be greatly appreciated.

Please note that sudo is not an option as my user is not on the sudoer list.

Things I've tried - Passing the password in using pipes Didn't work because of "su must be used from terminal" type error - Passing the password using echo Whatever was echoed would simply show up after the password was entered

Improve this question
13
  • 1
    Depending on the OS you might be able to reboot into single user mode and reset the root password. Otherwise, reboot from a live distribution, mount the local installed OS and reset the root password.
    – Lambert
    Commented Jan 6, 2016 at 9:54
  • what about echo "passwd" | sudo -S your_command?
    – Pandya
    Commented Jan 6, 2016 at 10:10
  • @Pandya Generally yes, though the OP did say "Please note that sudo is not an option as my user is not on the sudoer list." . :)
    – Malte Skoruppa
    Commented Jan 6, 2016 at 10:13
  • 1
    So, you want us to help you break into somebody else's system?
    – terdon ♦
    Commented Jan 6, 2016 at 10:31
  • 1
    @MalteSkoruppa none whatsoever. I was hoping the OP would give a benign reason to do this to assuage my fears of wrongdoing.
    – terdon ♦
    Commented Jan 6, 2016 at 14:15

2 Answers 2

Reset to default
2

Doing this "oneline style"

expect -c 'spawn su - ;expect Password:;send "your-password\n";interact'

Take a look at the output of su - to guarantee if this is the right phrase that appears to capture a password. I'm using a translated version of Linux here so, the word would be "Senha:" instead of "Password:".

  • expect -c '': Run the following actions to this command
  • spawn su -: Execute this command
  • expect Password: Expect the word password to do something
  • send "your-password\n": Type in your password, followed by an Enter
  • interact: Keep interaction ready to the command.
Improve this answer
3
  • This worked. Thank you very much for the clear dissection of the commands.
    – HyperSphere
    Commented Jan 6, 2016 at 17:47
  • Ok, I understand why this is not working. My non-root user is not on the sudoer list. Is there a way to add him to the list? If not, is there another way to have the user attempt to login as root without requiring any special permissions?
    – HyperSphere
    Commented Jan 26, 2016 at 8:21
  • If you have the root password, you can use su - to get a root shell. To add people to the sudoers list, you will need to first access the system as root and execute the visudo command to grant some privileges that will require(or not) a password. It would be a system failure if you could get root access whenever you want(and without using exploits/bugs), dont you think?
    – user34720
    Commented Jan 26, 2016 at 10:02
1

You can use expect to do that job for you. Save the following to a file, make it executable, and run it:

#!/usr/bin/expect
spawn su
expect "Password:"
send "YOUR_PASS\n"
interact

(Obviously, you need to specify the correct path to expect. Here I used /usr/bin/expect as an example.)

If YOUR_PASS is the correct root password, you should now have a root shell. If not, you get an authentication failure.

Note that the interact command will probably not be needed in the context of a fully automated script, as it gives control of the process to the user, i.e., keystrokes are sent to the current process and stderr and stderr are returned.

See man expect for a more detailed description of the commands spawn, expect, send and interact, and many other commands.

Improve this answer
5
  • Thank you, great help. Quick question though, why does the answer above not require the specification of a file directory for expect and this one does?
    – HyperSphere
    Commented Jan 6, 2016 at 17:49
  • @HyperSphere This is an executable script, and the kernel needs to need what interpreter it should use in order to execute it. This is why it begins with the Shebang #!, followed by the path to the interpreter. The other answer executes the command expect in the context of a shell, such as bash. If no path is given, the shell will look for an executable named expect in all directories specified in the environment variable $PATH, and execute the first it finds with the given arguments.
    – Malte Skoruppa
    Commented Jan 7, 2016 at 1:47
  • The two answers are actually pretty much the same, only written in a slightly different way. Both allow you to execute the expect script in the context of a larger shell script: Either by calling the expect script above, or by using the one-liner from the other answer. Both are fine. A self-contained expect script is probably better for more complex scripts, while the one-liner is easier for simple scripts.
    – Malte Skoruppa
    Commented Jan 7, 2016 at 1:59
  • Ok, I understand why this is not working. My non-root user is not on the sudoer list. Is there a way to add him to the list? If not, is there another way to have the user attempt to login as root without requiring any special permissions?
    – HyperSphere
    Commented Jan 26, 2016 at 8:21
  • What exactly "is not working" for you? In the above script, su is used to attempt to login as root; no special privileges are needed to do that, save the root password (in particular, you do not need to be in the sudoers list, which is only relevant for the sudo command.) If you could just add yourself to the sudoers list, then you could also just make yourself root without the root password.
    – Malte Skoruppa
    Commented Jan 26, 2016 at 11:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .