Linux Privilege Escalation via Automated Script

We all know that, after compromising the victim’s machine we have a low-privileges shell that we want to escalate into a higher-privileged shell and this process is known as Privilege Escalation. Today in this article we will discuss what comes under privilege escalation and how an attacker can identify that low-privileges shell can be escalated to higher-privileged shell. But apart from it, there are some scripts for Linux that may come in useful when trying to escalate privileges on a target system. This is generally aimed at enumeration rather than specific vulnerabilities/exploits. This type of script could save your much time.

Table of Content

·         Introduction

·         Vectors of Privilege Escalation

·         LinuEnum

·         Linuxprivchecker

·         Linux Exploit Suggester 2

·         Bashark

·         BeRoot

Introduction

Basically privilege escalation is a phase that comes after the attacker has compromised the victim’s machine where he try to gather critical information related to system such as hidden password and weak configured services or applications and etc. All these information helps the attacker to make the post exploit against machine for getting higher-privileged shell.

Vectors of Privilege Escalation

§  OS Detail & Kernel Version

§  Any Vulnerable package installed or running

§  Files and Folders with Full Control or Modify Access

§  File with SUID Permissions  

§  Mapped Drives (NFS)

§  Potentially Interesting Files

§  Environment Variable Path

§  Network Information (interfaces, arp, netstat)

§  Running Processes

§  Cronjobs

§  User’s Sudo Right

§  Wildcard Injection

There are several script use in Penetration testing for quickly identify potential privilege escalation vectors on Windows systems and today we are going to elaborate each script which is working smoothly.

LinuEnum

Scripted Local Linux Enumeration & Privilege Escalation Checks Shellscript that enumerates the system configuration and high-level summary of the checks/tasks performed by LinEnum.

Privileged access: Diagnose if the current user has sudo access without a password; whether the root’s home directory accessible.

System Information: Hostname, Networking details, Current IP and etc.

User Information: Current user, List all users including uid/gid information, List root accounts, Checks if password hashes are stored in /etc/passwd.

Kernel and distribution release details.

You can download it through github with help of following command:

git clone https://github.com/rebootuser/LinEnum.git

Once you download this script, you can simply run it by tying ./LinEnum.sh on terminal. Hence it will dump all fetched data and system details.

Let’s Analysis Its result what is brings to us:

OS & Kernel Info: 4.15.0-36-generic, Ubuntu-16.04.1

Hostname: Ubuntu

Moreover…..

Super User Accounts: root, demo, hack, raaz

Sudo Rights User: Ignite, raj

Home Directories File Permission

Environment Information

And many more such things which comes under the Post exploitation.

Linuxprivchecker

Enumerates the system configuration and runs some privilege escalation checks as well. It is a python implementation to suggest exploits particular to the system that’s been taken under. Use wget to download the script from its source URL.

wget http://www.securitysift.com/download/linuxprivchecker.py

Now to use this script just type python linuxprivchecke.py on terminal and this will enumerate file and directory permissions/contents. This script works same as LinEnum and hunts details related to system network and user.

python linuxprivchecker.py

Let’s Analysis Its result what is brings to us.

OS & Kernel Info: 4.15.0-36-generic, Ubuntu-16.04.1

Hostname: Ubuntu

Network Info: Interface, Netstat

Writable Directory and Files for Users other than Root: /home/raj/script/shell.py

Checks if Root’s home folder is accessible

File having SUID/SGID Permission

For example: /bin/raj/asroot.sh which is a bash script with SUID Permission

Linux Exploit Suggester 2

Next-generation exploit suggester based on Linux_Exploit_Suggester. This program performs a 'uname -r' to grab the Linux operating system release version, and returns a list of possible exploits.

This script is extremely useful for quickly finding privilege escalation vulnerabilities both in on-site and exam environments.

Key Improvements Include:

·         More exploits

·         Accurate wildcard matching. This expands the scope of searchable exploits.

·         Output colorization for easy viewing.

·         And more to come

git clone https://github.com/jondonas/linux-exploit-suggester-2.git

cd linux-exploit-suggester-2

You can use the '-k' flag to manually enter a wildcard for the kernel/operating system release version.

./linux-exploit-suggester-2.pl -k 3.5

Bashark

Bashark aids pentesters and security researchers during the post-exploitation phase of security audits.

Its Features

·         Single Bash script

·         Lightweight and fast

·         Multi-platform: Unix, OSX, Solaris etc.

·         No external dependencies

·         Immune to heuristic and behavioural analysis

·         Built-in aliases of often used shell commands

·         Extends system shell with post-exploitation oriented functionalities

·         Stealthy, with custom cleanup routine activated on exit

·         Easily extensible (add new commands by creating Bash functions)

·         Full tab completion

Execute following command to download it from the github:

git clone https://github.com/TheSecondSun/Bashark.git

cd Bashark

To execute the script you need to run following command:

source bashark.sh

help

The help command will let you know all available options provide by bashark for post exploitation.

With help of portscan option you can scan the internal network of the compromised machine.

To fetch all configuration file you can use getconf option. It will pull out all configuration file stored inside /etc directory. Similarly you can use getprem option to view all binaries files of the target‘s machine.

portscan < target’s IP>

getconf

getprem

BeRoot

BeRoot Project is a post exploitation tool to check common misconfigurations to find a way to escalate our privilege. This tool does not realize any exploitation. It mains goal is not to realize a configuration assessment of the host (listing all services, all processes, all network connection, etc.) but to print only information that have been found as potential way to escalate our privilege.

git clone https://github.com/AlessandroZ/BeRoot.git

cd Linux

chmod 777 beroot.py

To execute the script you need to run following command:

./beroot.py

It will try to enumerate all possible loopholes which can lead to privilege Escalation, as you can observe the highlighted yellow color text represents weak configuration that can lead to root privilege escalation whereas the red color represent the technique that can be used to exploit.

It’s Functions:

Check Files Permissions

SUID bin

NFS root Squashing

Docker

Sudo rules

Kernel Exploit

Conclusion: Above executed script are available on github, you can easily download it from github. These all automated script try to identify the weak configuration that can lead to root privilege escalation.

Meterpreter File System Commands Cheatsheet

Hey Friends!

Did you know that meterpreter is known as Hacker’s Swiss Army Knife!!

Well! Know you do.

Meterpreter, a highly developed payload that can be extended dynamically, is known to be Hacker’s Swiss Army Knife. It uses reflective DLL injection technique to further compromise the target after attack. Meterpreter is known to influence the functionality of Metasploit framework. It can help in doing a lot many things. Some of these include covering tracks after the attack, accessing operating system, and dumping hashes.

This article discusses meterpreter’s Stdapi File System Commands. There are 21 commands including cat, cd, pwd, and checksum. Figure 1 summarises them:

Let’s start discussing them.

cat: It is the very first command in the group of Stdapi File System Commands. It reads the contents of a file to the screen. In other words, cat displays a file’s contents. cat command in meterpreter is same as cat command used in Unix/Linux systems. 

The syntax of cat in meterpreter is as follows:

cat filename

cd and pwd: Though cd and pwd commands are two separate commands, they are usually used together. cd stands for change directory and pwd stands for print working directory. You use pwd command to check the directory you are working in. You can change this directory using cd command. By default, current working directory is the one where the connection was established.

The syntaxes of pwd and cd commands in meterpreter are as follows:

pwd

cd

checksum: This command retrieves the checksum of a file. The syntax of checksum command is as follows:

checksum [md5/sha1] file1 file2 file 3...

cp: This command copies the content of source to destination. The syntax of cp command is as follows:

cp < newfile>

dir: This command lists files. It is an alias for the ls command. It provides crucial details related to any file or directories such as File Permissions, Size of File, Last modified date and file Name & Type. The syntax of dir command is as follows:

dir

download: This command downloads remote files and directories from remote location to the local machine. The syntax of download command is as follows:

download [options] src1 src 2 src3... destination

edit: This command edits a file. The syntax of edit command is as follows:

edit

When you press the Enter key, the screen displayed is as shown in the below image:

After editing the file, type :q! to save the changes and exit, as shown in the below image

getlwd: This command prints local working directory. The syntax of getlwd command is as follows:

getlwd

getwd: This command prints working directory. The syntax of getwd command is as follows:

getwd

lcd: This command changes local working directory. The syntax of lcd command is as follows:

lcd

You can see that local working directory changes to /root/Desktop

lls: This command lists local files. The syntax of ls command is as follows:

lls

lpwd: This command prints local working status. It is same as the getlwd command. The syntax of lpwd command is as follows:

lpwd

ls: This command lists files. The syntax of ls command is as follows:

ls

mkdir: This command makes directory. The syntax of mkdir command is as follows:

mkdir dir1 dir2 dir3...

mv: This command moves source to destination.  The syntax of mv command is as follows:

mv oldfile newfile

You can see the moved contents using cat command.

pwd: This command prints working directory. The syntax of pwd command is as follows:

pwd

rm: This command deletes the specified file. The syntax of rm file is as follows:

rm file1 [file2...]

You can see the list of files before and after using rm command.

rmdir: This command removes directory. The syntax of rmdir command is as follows:

rmdir dir1 dir 2 dir 3...

search: This command search for files. The syntax of search command is as follows:

search –f *.doc

show_mount: This command list all mount points/logical drives. The syntax of show_mount command is as follows:

show_mount

upload: This command uploads a file or directory. The syntax of upload command is as follows:

upload [options] src1 src2 src3... destination

You can see the uploaded file, as shown in the below image: