Cdtjkyj

I have an error
sh: line 61: cd: HOME not set.

Distribution: Metasploitable 2 (Ubuntu 8.04)

/root/.bashrc (comments and whitespace removed):

[ -z "$PS1" ] && return

shopt -s checkwinsize

[ -x /usr/bin/lesspipe ] && eval "$(lesspipe)"

if [ -z "$debian_chroot" -a -r /etc/debian_chroot ]; then

    debian_chroot=$(cat /etc/debian_chroot)

fi

case "$TERM" in

xterm-color)

    PS1='${debian_chroot:+($debian_chroot)}[33[01;32m]u@h[33[00m]:[33[01;34m]w[33[00m]$ '

;;

*)

    PS1='${debian_chroot:+($debian_chroot)}u@h:w$ '

    ;;

esac

case "$TERM" in

xterm*|rxvt*)

    PROMPT_COMMAND='echo -ne "33]0;${USER}@${HOSTNAME}: ${PWD/$HOME/~}07"'

    ;;

*)

    ;;

esac

if [ "$TERM" != "dumb" ]; then

    eval "`dircolors -b`"

    alias ls='ls --color=auto'

fi

cat /root/.profile

# ~/.profile: executed by Bourne-compatible login shells.



if [ "$BASH" ]; then

    if [ -f ~/.bashrc ]; then

    . ~/.bashrc

    fi

fi



mesg n

ps -p $$ -ocomm=

sh

I tried to use "rlogin -l root x.x.x.x" from my kali to this machine, but it did not work. The .rhosts files are ok, but i get this error message, so maybe this is the reason why it doesnt work.

1) login with telnet using backdoor at 1524

2) login with samba userman script exploit:

3) ssh with password (cd is working):

When you log in via a normal method (on the console, over SSH, etc.), the program handling the login sets a few environment variables, including HOME. If you get access to a shell not via logging in, but by exploiting a vulnerability in a program, you get that program's environment, which often but not always includes HOME.

In bash, for some reason, the cd command with no argument uses the value of HOME as the target. Tilde expansion, however, falls back to the home directory from the user database (e.g. /etc/passwd) if HOME is not set. So if HOME is not set, cd complains, but cd ~ changes to the user's home directory. cd $HOME runs cd with no argument when HOME is not set.

When you're exploiting a vulnerability, you can't count on the environment being a familiar one. It's part of the craft of making an exploit — the easy part — to go from being able to execute code (e.g. having a shell) to setting up a convenient environment to run standard code.