I've looked at the other pages for getting locked out of ssh, but this is a bit more unique.

I am auditing a CentOS box with a custom ssh binary that acts differently than a normal one. To fix this, I thought I would upload a new binary, off my own linux machine. I labeled the old binary /usr/sbin/sshd.old and the new one is /usr/sbin/sshd. There is an error since Debian (my binary) and CentOS binaries are different so now I cannot connect using ssh anymore (big blunder on my part).

BUT, I still have an open SFTP connection (with non-root priv) that remains active and I can up/download files.

Is there anything I can do to regain my control simply via file transfer?

My open connection is on a kali box, and I am willing to regain control via other methods as well as I know this box is not entirely secure.

My thoughts were:

  1. Drop a reverse shell on the system so that I can access via some other method, but I am unsure how to execute the file if I did such

  2. Put a script in a cron directory to make a change, but I don't have the privileges

  3. The box is also running an apache webserver, with files being pulled from /var/www/html. Could I possibly upload a new html folder with code that would give me access? It runs off an initial index.php file, could I upload a new one with a shell or some other method of access?

Also, I'm relatively new to this site, so if there is a problem with my post, I would appreciate a supplementary explanation.


You can't do anything along the lines of what you described.

You are on sftp with an unprivileged user and if it was possible to change files wich would allow root access it would be a huge security flaw.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.