1

I have an Ubuntu 12.04 VirtualBox machine in which some days ago I changed the password. Now when I used the machine again I've forgotten the password and can't get root access.
I tried to get hashes from the shadow file to use with the john but I can't read without root access, even tried to get a session with Metasploit but can't find any option to get Linux hashes and neither could I get root privileges with Metasploit, and also can't access the disk offline as its VDI image.

Also tried but couldn't download john to Ubuntu as I can't use the apt-get either, the machine contains some important data.
So is there any way in Metasploit to get root or some tool (like samdump2 for Windows) to download through the browser and manually get the hashes from a live system or maybe some exploit?

migrated from security.stackexchange.com Dec 7 '15 at 19:23

This question came from our site for information security professionals.

  • This is not really a security question. – Neil Smithline Dec 5 '15 at 17:02
  • Restart the image, at Grub menu use edit option, add "single" to the line starting "linux", run, change password to something you know. Not really a security question, more a system administration one. – Matthew Dec 7 '15 at 9:20
2

First to address a common misconception: As long as you have physical access to a (real or virtual) machine there is no way (apart from encryption) to prevent you from getting to your data.

Now for the procedures (for more details see How do I reset a lost administrative password? on AskUbuntu.com)

using recovery

  1. When your VM boots press Left shift right after the boot screen to access the grub menu, select advanced options..., and there select any line containing recovery mode.
  2. After some time you will be presented wit another menu, there you use the arrow keys to select the line root, press enter.
  3. make the mounted / partition read/write (instead of read-only)

    mount -rw -o remount /
    
  4. now you are ready to change the password of your "lost" user

    passwd youruser

    you are prompted for a new password (you will not get any feedback, it looks like your keystrokes are not recognized), after having confirmed the new password you can reboot the machine and are ready to fly.

If the procedure above fails (for whatever reason) you can take route #2:

using a live CD (image) - the "chroot way"

  1. insert the ISO-image for a live CD into the virtual CD-Drive, boot from it, select Try Ubuntu from the menu, wait till the Desktop is ready
  2. open a Terminal window
    • CTRL+ALT+T on a real machine or Virtualbox VM
    • CTRL+ALT+space, T in a VMWare VM
  3. use sudo fdisk -l to see all available partitions, decide which one contains your / system (probably something like dev/sda1)
  4. mount that partition into some available path (usually /mnt)

    sudo mount /dev/sda1 /mnt
    
  5. we need access to a few paths

    for d in dev sys run proc; do sudo mount --bind /$d /mnt/$d; done
    
  6. now activate the new environment - you will be able to act with root permissions on your original system now.

    sudo chroot /mnt
    
  7. now you are ready to change the password of your "lost" user

    passwd youruser

using guestfs (if the host is Linux or OSX)

  1. Install the libguestfs-tools package, or whatever your distribution (the one on the host) calls it. If your distribution doesn't have this package, download it from upstream.

  2. Mount the virtual machine's root filesystem on the host. Adapt the paths as necessary for your installation.

    mkdir ~/mnt
    guestmount -a /path/to/vm-image.vdi -m /dev/sda1 ~/mnt
    

    Since you're using VirtualBox, you may need to run export LIBGUESTFS_BACKEND_SETTINGS=force_tcg first.

  3. Generate a new password hash for the password of your choice.

    mkpasswd -m sha-512
    
  4. Edit ~/mnt/etc/shadow to change the password hash for the root user to the one generated by mkpasswd.

  5. Unmount the VM's filesystem. You can now boot the VM and log in as root with your new password.

    fusermount -u ~/mnt
    rmdir ~/mnt
    
0

You can create a new VM in virtual box and add a second hardrive which is the harddrive (vmdk file) of your Ubuntu server.

You boot on this VM and acces to the /etc/shadow of your server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.