Updates privilege_escalation_-_linux.md

# Basics of linux

## 1. Basic commands

**pwd**

rm -rf ./directory

```

Watch the command destroy an enire machine: https://www.youtube.com/watch?v=D4fzInlyYQo

Watch the command destroy an enire machine: [https://www.youtube.com/watch?v=D4fzInlyYQo](https://www.youtube.com/watch?v=D4fzInlyYQo)

**rmdir**

**sudo**

List what rights the sudo user has.

```

sudo -l

```

Sudo config file is usually **/etc/sudoers**

## Finding files

There are mainly three ways to find files on linux. **Locate**, **find** and **which**.

### Locate

Locate is really fast because it relies on an internal database. So in order to have it updated you need to run:

```

Which searched the directories that are defined in your $PATH variable.

### Find

Find is slower but a lot more thorough. You can search for files recursively and with regex and a lot of other features.

```

# This will send all permissions denied outputs to dev/null.

find / -name file 2>/dev/null

```

## 2. Text-fu

 - https://linuxjourney.com/lesson/stderr-standard-error-redirect

* [https://linuxjourney.com/lesson/stderr-standard-error-redirect](https://linuxjourney.com/lesson/stderr-standard-error-redirect)

### cut

This is a useful command to cut in text.

Let's say that we have the following text, and we want to cut out the ip-address.

cut -d" " -f4

```

 `-d` stands for delimiter. and `-f` for field.  

`-d stands for delimiter. and -f for field.`

### sed - Stream editor

sed "1d"

```

### Show all lines just once

You have a list of passwords, or ip-addresses or whatever. And you want to remove all duplicates. How do you do it?

You have list:

```

aa

aa

```

And you want to see:

```

aa

bb

cat file.txt | tr "." "_"

```

http://www.thegeekstuff.com/2012/12/linux-tr-command/

[http://www.thegeekstuff.com/2012/12/linux-tr-command/](http://www.thegeekstuff.com/2012/12/linux-tr-command/)

### AWK

You can exclude the search portion or the action portion.

This just prints every line of the file.

```

awk '{print}' filename

```

#### Filtering capabilites

Filtering out specific ip-address:

```

awk '/172.16.40.10.81/' error.log

```

```

#### BEGIN and END statements

So if you are manipulating some text you might want to start the output with some info about the columns or something like that. To do that we can use the BEGIN-keyword.

```

awk 'BEGIN{printf "IP-address \tPort\n"} /nop/ {print $3} END {printf "End of the file\n"}' test.txt | tail

```

Here we are printing IP-address    PORT to the first line of the file.

## Vim

### Search

In command-mode:

```

/

```

#### Add character to the beginning of each line

I have needed to do this several time when I write batch-scripts that I want to copy-paste into a windows-machine using echo. Instead of having to add a `echo` on each line I want to do it all at onece.

I have needed to do this several time when I write batch-scripts that I want to copy-paste into a windows-machine using echo. Instead of having to add a `echo on each line I want to do it all at onece.`

Here is how you do it

drwxrwxrwt 2 root root 4,0K ago  3 17:33 myfile

```

Here we have 10 letters in the beginning. The first one `d` shows that it is a directory.

The next three letters are `r`for read, `w` for write and `x` for execute. The first three belong to the owner, the second three to the group, and the last three to all users.

Here we have 10 letters in the beginning. The first one `d shows that it is a directory.  

The next three letters are rfor read, w for write and x for execute. The first three belong to the owner, the second three to the group, and the last three to all users.`

https://linuxjourney.com/lesson/file-permissions

[https://linuxjourney.com/lesson/file-permissions](https://linuxjourney.com/lesson/file-permissions)

## 6. Processes

q                    F10         Quit htop

```

http://www.thegeekstuff.com/2011/09/linux-htop-examples/

[http://www.thegeekstuff.com/2011/09/linux-htop-examples/](http://www.thegeekstuff.com/2011/09/linux-htop-examples/)

## 7. Packages

I am talking about debian/ubuntu here. On other systems I don't know.

You can define your path in `/etc/environment`. If you don't have it you can create it and add the path like this:

You can define your path in `/etc/environment. If you don't have it you can create it and add the path like this:`

```

source /etc/environment && export PATH

```

If you are using zsh (which you should) you have to add it here

If you are using zsh \(which you should\) you have to add it here

```

sudo vim /etc/zsh/zshenv

source /etc/environment

```

### Adding a path

This is a non-persistent way to add binaries to your path. Might be useful if you have entered a system that has limited binaries in the path.

If you download a package that is not in the official repository you can put the binary in **/opt**. That is good place to put your binaries.

Now you need to add that path to your path-variable. Remember how we set that in **/etc/environment**. So now open up that file and add `/opt` to it, so i looks like this.

Now you need to add that path to your path-variable. Remember how we set that in **/etc/environment**. So now open up that file and add `/opt to it, so i looks like this.`

```

PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/opt"

I always add custom binaries last. That means that if we have two binaries with the same name the machine will first select the original binary. This way you won't have to fear screwing up, by accidentally creating a new **ls** binary for example.

## 8. Cronjobs

There are two ways to configure cronjobs. The first one is by putting scripts in the following folders.

fdisk -l

```

## 9. The Filesystem

### The Filesystem Hierarchy Standard

![](fss.jpg)  

This image is copied from here: http://askubuntu.com/questions/138547/how-to-understand-the-ubuntu-file-system-layout/138551#138551

This image is copied from here: [http://askubuntu.com/questions/138547/how-to-understand-the-ubuntu-file-system-layout/138551\#138551](http://askubuntu.com/questions/138547/how-to-understand-the-ubuntu-file-system-layout/138551#138551)

#### Difference between sbin and bin

Knowing how to mount and unmount might be useful if you want to get access to a remote NFS-directory. You will need to mount it to your filesystem to be able to browse it.

## Controlling services

### Systemctl

```

You can verify that the service is listening for connection by running network status.

```

netstat -apnt

```

Make ssh start upon boot

```

systemctl enable ssh

systemctl enable apache2

This is a tool to control services more easily, what is running upon boot and so on.

## 10. Boot the system

## 11. Kernel

## 16. Network basics

### Netstat - Find outgoing and incoming connections

Netstat is a multiplatform tool. So it works on both mac, windows and linux.

```

$ netstat -apaA inet

$ netstat -antlp

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name

tcp        0      0 mymachine:domain        *:*                     LISTEN      -               

tcp        0      0 localhost:ipp           *:*                     LISTEN      -               

udp        0      0 192.168.0.15:55065      ce-in-f189.1e100.:https ESTABLISHED 3120/chrome

```

A few interesting things to observe here is that my machine is using any port over 1024 to connect to the outside. So it is not like just because we communicate with https and connect to port 443 that we use that port on our machine. On our machine it can be any port (over 1024) and usually any port over 10000.

A few interesting things to observe here is that my machine is using any port over 1024 to connect to the outside. So it is not like just because we communicate with https and connect to port 443 that we use that port on our machine. On our machine it can be any port \(over 1024\) and usually any port over 10000.

Find out what services are listening for connection on your machine  

Flags

```

-a # All

-n # show numeric addresses

-t # tcp

```

```

netstat -anpt

```

Or you can use tcpdump, or iptables.

Every listening process of course has a PID, but unless you are root you can't might not see them all.

### Firewall - Iptables

Iptables is a firewall tool in linux. A firewall is basically a tool that scans incoming and/or outgoing traffic. You can add rules to the iptables to filter for certain traffic.

Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination

```

So as we can see the current policy is to accept all traffic in all directions.

If you for some reason has been tampering with the iptables and maybe fucked up. This is how you return it to the default setting, accepting all connections

```

iptables --policy INPUT ACCEPT

 iptables --policy OUTPUT ACCEPT

iptables -A INPUT -s 192.168.1.0/24 -j DROP

```

Now if we want to see our current rules we just do

```

iptables -L

```

And we can now see our new rule.

To add line-numbers for each rule, so that you can then specify which rule you want to reset or change or something you can output the rluels with line-numbers

iptables -A OUTPUT -d 198.23.253.22 -j DROP

```

https://www.digitalocean.com/community/tutorials/how-to-list-and-delete-iptables-firewall-rules

[https://www.digitalocean.com/community/tutorials/how-to-list-and-delete-iptables-firewall-rules](https://www.digitalocean.com/community/tutorials/how-to-list-and-delete-iptables-firewall-rules)

### Troubleshooting

#### Magical rfkill

If for some reason the wifi is blocked you can unblock it (or block it) with rfkill.

If for some reason the wifi is blocked you can unblock it \(or block it\) with rfkill.

```

$ rfkill list

## References

https://linuxjourney.com/

https://github.com/jlevy/the-art-of-command-line

[https://linuxjourney.com/](https://linuxjourney.com/)  

[https://github.com/jlevy/the-art-of-command-line](https://github.com/jlevy/the-art-of-command-line)

These are all things we want to be able to do.  

Watch this video!  

http://www.irongeek.com/i.php?page=videos/bsidesaugusta2016/its-too-funky-in-here04-linux-privilege-escalation-for-fun-profit-and-all-around-mischief-jake-williams

[http://www.irongeek.com/i.php?page=videos/bsidesaugusta2016/its-too-funky-in-here04-linux-privilege-escalation-for-fun-profit-and-all-around-mischief-jake-williams](http://www.irongeek.com/i.php?page=videos/bsidesaugusta2016/its-too-funky-in-here04-linux-privilege-escalation-for-fun-profit-and-all-around-mischief-jake-williams)

http://www.slideshare.net/nullthreat/fund-linux-priv-esc-wprotections

[http://www.slideshare.net/nullthreat/fund-linux-priv-esc-wprotections](http://www.slideshare.net/nullthreat/fund-linux-priv-esc-wprotections)

http://netsec.ws/?p=309

[http://netsec.ws/?p=309](http://netsec.ws/?p=309)

https://www.rebootuser.com/?page_id=1721

[https://www.rebootuser.com/?page\_id=1721](https://www.rebootuser.com/?page_id=1721)

**Don't use binary exploits if you can avoid it. If you use it it might crash the machine. So binary exploits should be the last resort. Always use a simpler priv-esc if you can. They can also produce a lot of stuff in the sys.log**

# Internal Enumeration - Linux

We can enumarate the system manually. Or using a script. This is a great script to use for internal enumeration.

## LinEnum

https://github.com/rebootuser/LinEnum

[https://github.com/rebootuser/LinEnum](https://github.com/rebootuser/LinEnum)

Here are the options:

```

-k Enter keyword

-e Enter export location

-t Include thorough (lengthy) tests

-r Enter report name

-h Displays this help text

```

If you are wondering how to get the script onto the machine, check out that chapter. https://bobloblaw.gitbooks.io/security/content/transfering_files.html

If you are wondering how to get the script onto the machine, check out that chapter. [https://bobloblaw.gitbooks.io/security/content/transfering\_files.html](https://bobloblaw.gitbooks.io/security/content/transfering_files.html)

## Unix privesc

http://pentestmonkey.net/tools/audit/unix-privesc-check

[http://pentestmonkey.net/tools/audit/unix-privesc-check](http://pentestmonkey.net/tools/audit/unix-privesc-check)  

Run the script and save the output in a file, and then grep for warning in it.

## Linprivchecker.py

https://github.com/reider-roque/linpostexp/blob/master/linprivchecker.py

[https://github.com/reider-roque/linpostexp/blob/master/linprivchecker.py](https://github.com/reider-roque/linpostexp/blob/master/linprivchecker.py)

# Manually

/var/spool/mail

```

## Logs

## References

http://www.rebootuser.com/?p=1758

http://netsec.ws/?p=309

[http://www.rebootuser.com/?p=1758](http://www.rebootuser.com/?p=1758)

[http://netsec.ws/?p=309](http://netsec.ws/?p=309)

# Privilege Escalation - Linux

### Configuration mistakes

#### Programs running as root

**Web-server**  

Running as root

```

If neither of those won't workyou can use a User Defined Function. UDP. This has worked for me:  

https://infamoussyn.com/2014/07/11/gaining-a-root-shell-using-mysql-user-defined-functions-and-setuid-binaries/

[https://infamoussyn.com/2014/07/11/gaining-a-root-shell-using-mysql-user-defined-functions-and-setuid-binaries/](https://infamoussyn.com/2014/07/11/gaining-a-root-shell-using-mysql-user-defined-functions-and-setuid-binaries/)

#### Bad path configuration

Putting . in the path  

If you put a dot in your path you won't have to write `./binary` to be able to execute it. You will be able to execute any script or binary that is in the current directory.

If you put a dot in your path you won't have to write `./binary to be able to execute it. You will be able to execute any script or binary that is in the current directory.`

Why do people/sysadmins do this? Because they are lazy and won't want to write `./`.

Why do people/sysadmins do this? Because they are lazy and won't want to write `./.`

This explains it  

https://hackmag.com/security/reach-the-root/

[https://hackmag.com/security/reach-the-root/](https://hackmag.com/security/reach-the-root/)  

And here  

http://www.dankalia.com/tutor/01005/0100501004.htm

[http://www.dankalia.com/tutor/01005/0100501004.htm](http://www.dankalia.com/tutor/01005/0100501004.htm)

#### **Cronjob**

With privileges running script that are editable for other users.

#### World writable scripts invoked as root

World/user writable scripts that are invoked by root can me rewritten to escalate privileges.

Also check scripts that are called by these scripts.

find / \( -perm -o w -perm -o x \) -type d 2>/dev/null

```

#### World/user writable binaries

#### Weak permissions on LD_preload

#### Weak permissions on LD\_preload

https://blog.maleadt.net/2015/02/25/sudo-escalation/

[https://blog.maleadt.net/2015/02/25/sudo-escalation/](https://blog.maleadt.net/2015/02/25/sudo-escalation/)

#### Homemade crappy suid programs

**SUID files**

SUID is a bit that you can set on a file. If you run a binary the binary is run as the user who is running it. But if the binary has the SUID-bit it will be run as the owner of that binary. This can be abused.

Here is how you find SUID files:

```

find / -perm -u=s -type f 2>/dev/null

```

### Abusing sudo-rights

If you have a shell that has limited sudo programs you might still be able to use it. Any program that can write or overwrite can be used. If you have `cp` you can overwrite `/etc/shadow` or `/etc/sudoers`. 

**ht**

The text/binary-editor HT running as sudo

If you have a shell that has limited sudo programs you might still be able to use it. Any program that can write or overwrite can be used. If you have `cp you can overwrite /etc/shadow or /etc/sudoers.   

`**`ht`**`  

The text/binary-editor HT running as sudo`

**nano**

**vi/vim**  

With vi it is even easier. Just open vi

```

sudo vi

:shell

:set shell=/bin/bash:shell    

:!bash

```

And you have shell.

**less**  

From less you can go into vi, and then into a shell

```

sudo less /etc/shadow

v

**more**  

You need to run more on a file that is bigger than your screen.

```

sudo more /home/pelle/myfile

!/bin/bash

**tcpdump**

https://www.securusglobal.com/community/2014/03/17/how-i-got-root-with-sudo/

[https://www.securusglobal.com/community/2014/03/17/how-i-got-root-with-sudo/](https://www.securusglobal.com/community/2014/03/17/how-i-got-root-with-sudo/)

```

echo $'id\ncat /etc/shadow' > /tmp/.test

chmod +x /tmp/.test

### Software vulnerabilites

Software vulnerabilites can lead to priv-esc, like vulnerabiliteis in:

- Kernel

```

uname -a

uname -r

/etc/issue*

/etc/release

cat /proc/version

* Kernel

  `uname -a`

  `uname -r`

  `/etc/issue*`

  `/etc/release`

  `cat /proc/version`

# RHEL/CentOS/Suse/Fedora

rpm -q kernel

# Debian

dpkg --list | grep linux-image

```

dpkg --list \| grep linux-image

```

**Tools**

```

# Programming tools

find / -name perl*

find / -name python*

find / -name gcc*

find / -name perl_  

find / -name python_  

find / -name gcc\*  

find / -name cc

# Upload tools

```

find / -name wget  

find / -name nc*

find / -name netcat*

find / -name nc  

find / -name netcat  

find / -name tftp*  

find / -name ftp  

```

# Writetable Directories

``` 

/tmp

/var/tmp

/dev/shm

/var/spool/vbox

/var/spool/samba

```

#### Binary expoits against root owned binaries

- sudo

- Chrootkit

* sudo

* Chrootkit

## Keylogger

If you have access to an account with sudo-rights but you don't have its password you can install a keylogger to get it.

## References

https://www.trustwave.com/Resources/SpiderLabs-Blog/My-5-Top-Ways-to-Escalate-Privileges/

[https://www.trustwave.com/Resources/SpiderLabs-Blog/My-5-Top-Ways-to-Escalate-Privileges/](https://www.trustwave.com/Resources/SpiderLabs-Blog/My-5-Top-Ways-to-Escalate-Privileges/)