Linux Privilege Escalation

Linux exploitation often boils down to what files are you able to read and write to, and do these files have any bearing on the security of the system.

A number of privilege escalation techniques are covered in this article, including:

• Basic Enumeration
• Automated Enumeration
• Kernel Vulnerabilities
• Files Containing Passwords
• Weak Permissions
• Creating an /etc/passwd backdoor
• SSH Key Access
• SUID Escalation
• SUDO Escalation
• Sudo LD_PRELOAD Exploitation
• Linux Capabilities Exploitation
• Cron Job Exploitation
• Cron Path Exploitation
• Shell Expansion Exploitation

Basic Enumeration

---

Automated Enumeration

Tool	Notes	URL
LinPEAS	Probably the most comprehensive.	https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
LinEnum	May find some items missed by LinPEAS.	https://github.com/rebootuser/LinEnum
Linux Exploit Suggestor	Useful for identifying Kernel vulnerabilities	https://github.com/mzet-/linux-exploit-suggester
Linuxprivchecker.py	Python based	https://github.com/sleventyeleven/linuxprivchecker
PSpy	Monitors processes executing, such as cron jobs	https://github.com/DominicBreuker/pspy

---

Kernel Vulnerabilities

Linux exploit suggester can be ran to determine potential vulnerabilities based on the running Kernel version:

The below example shows the DirtyCow vulnerability being triggered:

---

Files Containing Passwords

Passwords may be stored in unprotected configuration files. You can search for these using:

---

Weak Permissions

Find files the current user can read or write to. Readable files may contain credentials. Writeable files of interest include Bash and Python scripts we can edit, that may be run by other users on the system:

---

Creating an /etc/passwd backdoor

If you are able to modify /etc/passwd, you can add in a new root user without a password. An account entry in /etc/password typically looks like this:

The “x” character designates the users password is stored in /etc/shadow. The following two numbers are the user ID (UID) and group ID (GID) respectively.

If we create a new user without the “x” character, no password will be set. Setting the UID/GID to zero will also allow us to assume root privileges:

---

SSH Key Access

If SSH keys are not properly protected by filesystem permissions, it may be possible to use them to SSH into the system locally.

---

SUID Escalation

SetUID binaries will run in the context of another user. This is typically the root user.

The find command can be used to locate SetUID binaries. In general we’re looking for executables that don’t normally have SetUID permissions. In this instance, nmap has has these permissions so will be run as root.

We can exploit this configuration, by running nmap interactively and specifying a command:

---

Sudo Escalation

Sudo escalation is similar to exploiting SetUID binaries.

First, we can check which commands our user is able to run using sudo:

Researching these commands with gtfobins, there are a number of ways we can escalate privileges.

For instance, vim running as root via sudo can be used to execute system commands:

A large number of commands can be exploited by just typing an exclamation mark, followed by the command you want to run. Some examples of this:

less can also be used to execute commands;

The man command can be used;

Also ftp;

You get the gist

Other commands require setting certain command line parameters.

Apache can be used to read system files:

The find command requires setting the exec parameter:

If sudo if configured to allow executing an application that can be overwritten, it can be replaced with a simple shell binary. The following code can be used for this purpose.

The code can be compiled with;

---

Sudo LD_PRELOAD Exploitation

If LD_PRELOAD is enabled, you will likely see the following when you run sudo -l

LD_PRELOAD loads a shared library before other code executes.

We can created a Linux shared object to be loaded using the following code:

Compile the code, and execute with:

---

Linux Capabilities Exploitation

Linux capabilities allow software to execute with a certain set of rights which are normally reservered for the root user. For instance, an executable can be provided with the ability to capture packets without giving it the ability to read all files on the filesystem.

We can search for binaries with enabled capabilities with the following command:

A capability of +ep means that all capabilities are permitted when the application starts.

In this specific example, since Python is running as root we can exploit this by running a shell one liner;

---

Cron Job Exploitation

Cron job run tasks on a scheduled basis. In this example, reviewing the contents of /etc/crontab we can see a couple of Bash scripts are set to execute every minute.

If we have write access to myscript.sh or upload.sh, we may be able to add code that executes when the cronjob is run.

Additional cron files may also be found. Running a recursive listing should show them all:

---

Cron Path Exploitation

The top of the cron file specifies a path which is used to determine where executables should be run from.

In the previous example myscript.sh was not provided with an absolute path. Because of this, cron will check the path variable to determine where it should look for this file, starting with /home/user.

We can create /home/user/myscript.sh with the following contents:

Note, that later versions of bash may drop their privileges even with the SetUID flag set. In this instance, you can edit the script to add our user into sudoers file, allowing us to execute any command:

---

Shell Expansion Exploitation

Let’s say you have a script which runs regularly to perform a backup of files in a users home directory:

The asterisk used in the tar command will be expanded by the Bash shell to include all files in the directory. However, we can exploit this condition by creating files with arguments that will be parsed by the tar command. We can do that by creating the following files:

When the backup is run, the contents of shell.sh will also be executed.

---

Closing Thoughts

This post covers a few common Linux privilege escalation techniques, which are common on Capture the Flag systems. I’ll add some additional techniques over time.