Getting Root Terminal Access
Now that we have a root shell,
we can attempt to add some “quality of life” improvements.
As useful as our homemade terminal is,
a full-blown terminal session would be even better.
As mentioned previously,
we are limited by the fact that we don’t have access to terminal emulators.
However, Linux systems have built-in console sessions
called TTYs or virtual consoles or terminals.
This is normally accessed from a Linux desktop with the keyboard shortcuts of
ctrl + alt + f3 through f6 ,
with each function key presenting a different session.
However, if we try these key combinations in our kiosk session,
they don’t work.
We can use xdotool
to programmatically send keyboard shortcuts via the command line
and verify that the shortcuts are actually being delivered
to the X windows environment.
Let’s use the following command in our gtkdialog terminal to test the shortcut.
In this case, the kiosk doesn’t respond,
which means virtual terminals may be disabled
in this restricted kiosk environment.
If this is the case, we should be able to change this with our root privileges.
However, this may require a system restart,
which will trigger the kiosk’s “self-healing” mechanism
and revert the system.
Let’s investigate this option further.
Inspection of the X11 configuration file reveals that
“DontVTSwitch” is uncommented,
which means VT switching is disabled.
VT switching refers to the ability to switch
dynamically between virtual terminal interfaces.
To modify this, we’ll need to copy the original file to a temporary file
in our home folder.
Then we’ll adjust the permissions so we can edit it in Scratchpad.
Using our current guest-owned Firefox session to open Scratchpad,
We can then comment out “DontVTSwitch” in the X11 config file:
We can then copy it back to its original location and fix the permissions.
After replacing the file, we can again use openbox --replace
to restart the X session.
Now that we have VT switching enabled, we need to define a TTY for the system
in the /etc/inittab file.
We can copy it as we did with our last configuration file.
In the “Standard console login”
we discover that the two consoles are commented out
and none are defined for TTYs 3-6.
We’ll add a TTY
by adding a line to the “Standard console login” section
under the two commented lines.
This instructs the TTY to automatically log in as the root user.
We then need to copy the file back to its original location.
We can dynamically reload the settings without rebooting the system,
using the init q command
At this point, if we were physically located at the kiosk,
we could use xdotool key Ctrl+Alt+F3 to switch to a TTY terminal session.
However, because we are accessing the kiosk through VNC,
we must perform a few extra steps.
Using Scratchpad, we can create a script containing the following code.
This will kill the existing VNC server instance and start a new one
connected directly to the virtual terminal.
After making the file executable,
we can run the script,
and after a few seconds,
we’re kicked out of our VNC session.
If we reconnect, we’re immediately presented with a text terminal interface,
logged in as the root user.
At this point, we have full root access to the system
in an actual terminal session.
Next we could begin moving laterally within the internal network.