We’re going to run a privilege escalation attack without using passwords,
sudo
or
su
.
For this, we’re going to use a local vulnerability. We’re going to target a Metasploitable
2 system, which is based on an outdated version of Ubuntu Linux. We need to look
for a local exploit that we can use after we have compromised the system. By identify‐
ing the version of the kernel by exploiting it, we discover the Linux kernel is 2.6.24.
We can find this by using
uname -a
after we are on the system. An
nmap
scan may
also be able to identify the version. Knowing the kernel version, we can look for a
vulnerability that attacks that version.
Keep in mind that a local vulnerability is one that requires that you
are already logged into the machine or you have some ability to
execute commands on the machine.
After identifying that a vulnerability is associated with
udev
, a device manager that
works with the Linux kernel, we can grab the source code. You can see in
Example 6-15
that I’ve used
searchsploit
to identify
udev
vulnerabilities. I know the
one I’m looking for is
8572.c
, based on some research I had done, so I can copy that
file from where it sits to my home directory so I can compile it. Since I’m working
from a 64-bit system, I had to install the
gcc-multilib
package in order to compile to a
32-binary (the architecture in use at my target). This is something I can identify by
using
uname -a
. After compiling the source code to an executable, the executable file
has to be copied somewhere it can be accessed remotely. Sticking it into the root of
my web server means I can get to it by using a protocol that isn’t commonly suspect.
When you compile, you get to determine the filename that comes
out of the compilation process. You do this using
-o
and then pro‐
viding the filename. In our example, I’ve used a filename that might
not be suspect if found on the target system. You can use whatever
filename makes you happy, as long as you remember the name so
you can retrieve it later.
Example 6-15. Staging the local exploit
root@yazpistachio# searchsploit udev
--------------------------------------- ----------------------------------------
Exploit Title | Path
|
(
/usr/share/exploitdb/
)
--------------------------------------- ----------------------------------------
Linux Kernel 2.6
(
Debian 4.0 / Ubuntu | exploits/linux/local/8478.sh
Linux Kernel 2.6
(
Gentoo / Ubuntu 8.10 | exploits/linux/local/8572.c
Linux Kernel 4.8.0 UDEV <
232
- Local | exploits/linux/local/41886.c
Linux Kernel UDEV < 1.4.1 -
'Netlink'
| exploits/linux/local/21848.rb
--------------------------------------- ----------------------------------------
