Privilege Escalation Ubuntu

Question

I am trying to learn how an attacker can escalate privileges in Ubuntu 10.04. I have heard that this can be done but no one has ever said how to do it. The best defense is knowing how it is done and doing it yourself. So to find out, I set up a computer running Ubuntu 10.04, linux kernel 2.36 I am having an awfully hard time doing this when the the shell being used is not root. I was wondering if anyone had a way of doing this because for a 2 weeks I have not been able to figure it out. Again, I am not breaking into a production system, just an extra machine that I have. If anyone could help me learn this, I would appreciate it. Thanks!

Answer 1

There is a training ground just for your purpose:

Nebula 2 is a complete linux distribution (virtual machine) for learning purposes to perform many Privilege Escalation vulnerabilities.

Nebula takes the participant through a variety of common (and less than common)
weaknesses and vulnerabilities in Linux. It takes a look at

 •SUID files
 •Permissions
 •Race conditions
 •Shell meta-variables
 •$PATH weaknesses
 •Scripting language weaknesses
 •Binary compilation failures 

At the end of Nebula, the user will have a reasonably thorough understanding
of local attacks against Linux systems, and a cursory look at some of the remote
attacks that are possible.

The fine guys there developed a course system using lessons, each lesson is accessible with a different username and password and each level is directed at a different attack vector.

You can reach further and grab Protostar (basic memory corruption) and Fusion (advanced memory corruption) training virtual-machines @ http://exploit-exercises.com/

Answer 2

Well, the idea of a secure operating system is of course not to allow privilege escalation. So there needs to be an unpatched vulnerability. While privilege escalation vulnerability usually get less priority than remotely exploitable bugs, they do get fixed over time.

For example there was a vulnerability in the Linux Kernel that caused it to write core dump files of crashed applications into the current working directory without checking permissions. So an attacker could write a program that sets the working directory to for example /etc/cron.d and crash it. With a bit of preparation cron would be able to do something "useful" with the core dump file.

Another related attack is based on an insecure file creation vulnerability. A broken application may try to create a temporary file in a public writeable directory (e. g. /tmp) without forcing create-only. The attacker will create a symlink pointing elsewhere (where the attacker does not have write permission). The vulnerable application will overwrite the target file (e. g. /home/someuser/.profile for normal users and a system file for root).

I think two example are enough for now.

Taking a fully patched system and trying to exploit it, is not a good approach for learning about such issues. I recommend reading the Secure Programming for Linux and Unix HOWTO. Base on this knowledge you can play around: Write a simple application that violates one of those rules and then try to exploit it.

Answer 3

This is a very broad question, and is unsuited to the format of this site. I would advise looking on insecure.org or one of the other security advisory sites, where you will find examples such as http://seclists.org/bugtraq/2011/May/171 - which is actually from a Debian security advisory, but describes a number of linux issues including escalation of privilege.

You can search advisory lists for terms such as Ubuntu, Linux or Privilege.