Writeups

Linux Privilege Escalation - TryHackMe Medium Room

Task 1:

Login to [email protected] using password password321.

Task 2 - Service Exploit:

mysql was seen running in the server so used a classic mysql technique mentioned here

Task 3 - Weak File Permissions – Readable /etc/shadow

Since the file /etc/shadow could be read out by the user the hashed password of the root could be extracted which is this. Cracked the hash using john.

Task 4 - Weak File Permissions – Writable /etc/shadow

ls -l /etc/shadow showed that the file could be written by the current user.

mkpasswd -m sha-512 <new-password> could be used to add the password and can be replaced with the root user password to get the privilege escalated.

Task 5 - Weak File Permissions – Writable /etc/passwd

• Check if the /etc/passwd file is writable, if yes then the privilege escalation is easy.
• Use openssl to hash a password as openssl passwd <new-password-here>
• Edit the /etc/passwd file and replace the x in the root:x:0:0:root:/root:/bin/bash to the hash output of the openssl.
• Use the new password to switch the user to root.

Task 6 - Sudo Shell Escape Sequences:

• sudo -l to list the binaries which the user can run as root and use it to gain privileges.

Task 7 - Sudo Enviornment Variables

• Look at sudo -l for the environment variables that are inherited.
• compile the file as shared file using gcc -fPIC -shared --nostartfiles -o /tmp/preload.so preload.c and run the file using a program that can be run as sudo making the LD_PRELOAD to be the object file as: sudo LD_PRELOAD=/tmp/preload.so vi.

• Another method:

  • For LD_LIBRARY_PATH in the sudo -l, this method is applicable.
  • Compile the file as shared.
  • Look at a script which can be run as sudo and get the ldd of the script/file.
  • Rename the object file with one of the names of the output of above and run sudo LD_LIBRARY_PATH=<path-to-obj-file> <script/program>.
  • This should spawn a bash script with sudoer privileges.

Task 8 - Cron Job File Permissions:

• /etc/crontab lists the files which is updated regularly so requires root privileges.
• Having a look at the crontab can give a advantage and looking at the files listed in the crontab which also is writable can give a chance of privilege escalation.
• In this exercise, we look at the overwrite.sh script which is also listed in crontab and also writable.
• Edited the overwrite.sh to establish a reverse shell and got the root reverse shell.

Task 9 - Cron Jobs:- PATH Environment Vatiable:

• cat /etc/crontab to listout the system-wide crontab.
• echo the PATH variables and note/add a directory which can be accessed by the current user.
• create a file with the same name as a file in the crontab in the directory mentioned above.
• Since the filename is same and is in the directory mentioned in the PATH variable, it should execute our file which can be used to establish a reverse shell.

Task 10 - Cron Jobs:- Wildcards:

• Other component of /etc/crontab included /usr/local/bin/compress.sh

• Having a look into the bash script, it was tar czf /tmp/backup.tar.gz *, since there was a wildcard * in the script operating with tar, It could be exploited.

• Having a look at GTFOBins, we found tar has a command line option that let us run other commands as part of a checkpoint feature.

• Creating a reverse shell file in the PATH dir --checkpoint and --checkpoint-action=exec=<rev-shell>
• When the tar command is run, the wildcard will expand to include these files and since these filenames are valid tar commands tar will treat them as valid command line arguments.
• Finally a reverse shell with root privileges will be spawned with the reverse shell file we provide.

SUID/SGID

• SUID - Set owner User ID
• SGID - Set Group ID

Task 11 - SUID/SGID Executables :- Known Exploits

• find / -type f -a \( -perm -u+s -o -perm -g+s \) -exec ls -l {} \; 2>/dev/null to find all the SUID/SGID executables.
• find / -type f -perm /4000 2>/dev/null can also be used.
• Get the list of SUID/SGID Files and search for their exploit from exploit-db, GTFOBins, etc.

Task 12 - SUID/SGID Executables :- Shared Object Injection

• Find a SUID executable file and run strace to find the open/access calls for “no such file” errors using strace <path-to-SUID-exec-file> 2>&1 | grep -iE "open|access|no such files".
• Create the file which the SUID Exec file loads with a reverse shell/bash terminal like this file compiled.

This should make the file with SUID open the just created file with root privileges 
And since it is a reverse shell\bash shell, 
It should spawn a bash shell with root privilege.

Task 13 - SUID/SGID Executables :- Environment Variables

• Look at the files with SUID/SGID Privileges.
• cat/strings/strace the file to find out some services the file use.
• If the path of the services isn’t mentioned properly, add the path which can be manipulated by current user to PATH and modify the services used by the binary.
• The file name can be same as the service name and can spawn a shell.

Task 14 - SUID/SGID Executables :- Abusing Shell Features #1

• If full path to the service is mentioned in a file with SUID/SGID Exec, then a bash function named to same file can be created and exported with full path of the file like function /usr/sbin/service { /bin/bash -p; } and export using export -f /bin/sbin/service.
• This should work with bash version < 4.2-048

Basically what it does is use a variable in bash as the path to the file which points to our function.
Since the PATH in the SUID/SGID File points to a bash function, it is executed before actually reaching out to the actual file path.

Task 15 - SUID/SGID Executables :- Abusing Shell Features #2

• When the SUID Executable file is run with bash debugging then PS4 variable is set to an embedded command which creates an SUID version of /bin/bash.

env -i SHELLOPTS=xtrace PS4='$(cp /bin/bash /tmp/rootbash; chmod +xs /tmp/rootbash)' /usr/local/bin/suid-env2

• Run the /tmp/rootbash -p to get the bash shell with root privileges.

Password & Keys

Task 16 - Password & Keys :- History Files

• To view the contents of history cat ~/.*history | less

Task 17 - Password & Keys :- Config Files

• Files having read permissions may possibly store passowrd and username, check for the file.

Task 18 - Password & Keys :- SSH Keys

• Look for a .ssh file and check if it is readable from the current user permissions.
• Check for the root_key which is the private key for the ssh file.
• Use chmod to change the file permissions of root_key to 600 = rw.
• use ssh -i root_key root@<ip> to get into the server.

NFS

• File created via NFS inherit remote user’s ID, if the user is root, and root squashing is enabled, then ID will instead be set to the “nobody” user.

• cat /etc/exports to find the path
• mount the path using mount -o rw,vers=2 10.10.10.10:/tmp /tmp/nfs after creating a /tmp/nfs directory.
• use msf to get a reverse shell

Kernel Exploits:

• use linux-exploit-suggester-2.pl tool to identify potential exploits on the system.
• use the exploit to get the privileges escalated to root!