Hardcoding Passwords in scripts!!! What could go wrong?

It was a lovely Friday afternoon and i was creating reports for the 2 Penetration tests I executed during the week. The mood was already for the weekend and we were busy cracking jokes and working at the same time.
One of our team mates was not in a mood though. When asked he said he has been on this box since morning and no breakthrough yet. We said that as long as you have checked everything it should be alright. It may happen that the box is really well configured!!!

He said well I have checked everything but do you mind running through it once again quickly to make sure I have covered everything. As i was almost done with my report. I gave him to review my report ;) and I headed to take a quick pick on the box.

I was already interested as this seemed to be a tough one. I checked the nmap report. Things looked fine.
Checked the Brute Force worlists used to crack SSH – Those were fine. I invested some time to go through the discovered services and the known vulnerabilities but nothing seemed exploitable.

I was heading towards trying a Zero day angle. Suddenly i had an idea to just browse the system manually.

I asked my team mate if he has got a low level creds on the box. He said yes as part of the test data that have given us a low level shell access. Awesome! Did you try to do a privilege Escalation and become Root?
He said yes i did try that but nothing worked.

If you are a pen tester you would know privilege escalation is not an easy task. See the blogs here for tips and tricks on privilege escalation. I was sure that my mate would have used a script to check for possible priv escalation means and attempted them one by one. So to verify i decided to do this manually. And i already knew that most of the steps were already tried so I was looking for something else. I asked him to show me the output of the script that showed possible priv. escalation means. Looking at it I could not see anything special. I was about to give my ok to him when my eyes got stuck on a command in the script:
grep -l -i password /var/log/*.log 2>/dev/null
This was used to search for the keyword “password” in the specified directory. I ran the command again and there was no fruitful match. I decided to change the path to point to the project directory.
grep -l -i password ~/Projects/Projectname/ 2>/dev/null
(actual path not shown above)
However still no fruitful result. I decided not to give up and I did this:
grep -l -i pass ~/Projects/Projectname/ 2>/dev/null
Changed the keyword to ‘pass’ instead of ‘password’ thinking someone might just use pass.
Bingo!!! 2 files appeared. I was super excited now. These were 2 scripts for backup jobs. Opening the script content was a Treat. The same password was used in both of them for a user called admin. This was a 16 character alphanumeric and special characters password. No wonder why the brute force did not work!!
Next was to try ssh to the box with this new password :) Within seconds we were admin on the box.
To my surprise sudo access was allowed and so in next few seconds I was root on the box. WOOT WOOT… Game over!!!
Now the possibilities were unlimited depending on the scope that my mate was working on. I left it to him from that point onwards. He gave credit to me for Pwning this box :) and an invite for beers. What wlse you need to end a week and headstart a weekend.
Learning: Never store clear text password in scripts.
Note2self and fellow pentesters: Add a line in your privilege escalation script to add the new keyword or modify it to pass* and do a recursive search in all directories.