Linux Privilege Escalation
These are some techniques for Linux Privilege Escalation
Kernel Exploits
What is a Kernel?
THIS SHOULD BE YOUR LAST RESORT, Kernel exploits can be unstable and may crash the system!
Kernels are the core of any operating system
Think of it as a layer between application software and the actual computer hardware.
Kernel has the complete control over the operating system. This can result in execution as the root users
How do I find Kernel Exploits?
Enumerate kernel versions (uname -a )
Find matching exploits (Google, ExploitDB, GitHub)
Compile and run
Kernel Exploit Example
Kernel Version is 2.6.32
Using Searchsploit to find exploit
More specific search
Using Linux Exploit Suggesster 2
Looking at the results, we can see that we have a popular kernel exploit (Dirty COW)
Run exploit and execute /usr/bin/passwd binary
Service Exploits
What are Services?
Programs that run in the background, acceptin input or performing regular tasks.
If vulnerable services are running as root, exploitin them can lead to command exection as root.
Service exploits can be found using Searchsploit, Google and GitHub.
Services Running as Root
The follwing command will show all processes that are running as root.
With the results, as with any, try to identify the version number of the program being executed.
Enumerating Program Versions
Service Exploit Example
MySQL is running as root .
You can connect to MySQL as root without a password!
You can verify with:
This will list processes that run as root *mysqld
Why is this important?
MySQL has the ability to install user defined functions which run via shared objects. The following exploit can be used to install a new function that will allow us to execute system commands from a mysql command prompt. commands will be executed as root because mysql is running as root.
Port Forwarding
'Sometimes root processes may be bound to an internal port, through which it communicates. You can forward the port using the follwing SSH command:
Weak File Permissions
If permissions on files are weak, system files can be taken advantage of to perform privelege escalation.
/etc/shadow contains password hashes and by default is only readable by root.
If we can read this file, we may be able to crack the root users hash.
If we can modify, we can replace root user hash with a hash we know.
This is important, the first two colons contain the hash.in this case it is:
Cracking the hash
Writing to shadow
Similarly, because we can write onto the shadow file.
Reading and Writing passwd file
/etc/passwd used to contain hashes, back in the day.
passwd takes precedent over the shadow file
Backups
Eventhough backups may exist, they may be insecure backups. Check /home / (root) /tmp /var/backups
Running Sudo
Utilizing Apache
LD_Preload
LD_LIBRARY_PATH
This environment variable contains a set of directories where shared libraries are searched first
ldd command can be used to print the shared libraries used by a program
By creating a library with the same name as the one used by a program, and setting LDLIBRARY_PATH to its parent directory, the program will load our shared library instead.
CronJOBBERS
Cronjobs are programs or scripts that run at a scheduled time at certain time intervals
Crontabs store configuration for cronjobs. These are located at.
/var/spool/cron/
/var/spool/cro!n/crontabs/
systemwide /etc/crontab
File Permissions
Misconfiguration of a file permission associated with a cronjob can lead to easy Root!
Writing Paths present in Cronjobs
PATH Environment variable is by default set to /usr/bin/:bin
PATH variable can be overwritten in the crontab file
If cronjob does not use an absolute path, and one of the PATH directories is writeable by our user, we may be able to create a program/script with the same name as the cronjob
WildCards
On our Attacker Machine
On our target machine
Attacker machine
Last updated
Was this helpful?