Hacker News Reader

Comment by pif | Hacker News Reader

If you find the LILO prompt instead of the GRUB screen, use the option "init=/bin/sh" instead.

As already pointed, this is not an attacking method, but just a recovery method. From the POV of security, getting physical access to the console is already bad.

View on HN

Of course, totally agree. Yes, thanks for the LILO tip.

This is the best method. Use whatever boot loader you have (and you can provide your own via CD, USB, PXE, floppy, etc) to add a kernel argument to run a shell as init process. `mount -av` once booted should bring the filesystems in line.

If you find the BIOS is locked, the drive is encrypted, or you can't run your own bootloader (or edit theirs), use a DMA [1][2] or cold boot [3] attack. This should be the first thing you attempt if the machine is already booted up, in case the drive is encrypted. (Also trying a network attack using metasploit before trying the cold boot attack might net results)

  [1] http://www.breaknenter.org/projects/inception/
  [2] https://github.com/mrbreaker/mofo
  [3] http://www.linuxjournal.com/magazine/cold-boot-attack-tools-linux

Reply on news.ycombinator.com