5

I am trying to learn how an attacker can escalate privileges in Ubuntu 10.04. I have heard that this can be done but no one has ever said how to do it. The best defense is knowing how it is done and doing it yourself. So to find out, I set up a computer running Ubuntu 10.04, linux kernel 2.36 I am having an awfully hard time doing this when the the shell being used is not root. I was wondering if anyone had a way of doing this because for a 2 weeks I have not been able to figure it out. Again, I am not breaking into a production system, just an extra machine that I have. If anyone could help me learn this, I would appreciate it. Thanks!

3
  • 3
    If you can on-site reboot the system and aren't encrypting the hd, its trivial to boot into single user mode and do things as root without knowing any password. cyberciti.biz/faq/howto-boot-ubuntu-linux-rescue-mode (This isn't really privilege escalation; but users should be aware of this.)
    – dr jimbob
    Nov 28, 2011 at 17:08
  • yea thanks though. It won't work remotely though...
    – tpar44
    Nov 28, 2011 at 22:05
  • Try this one. sprunge.us/hfAJ It works on 10.10 too if you haven't upgraded your kernel. Dec 2, 2011 at 17:36

3 Answers 3

9

There is a training ground just for your purpose:

Nebula 2 is a complete linux distribution (virtual machine) for learning purposes to perform many Privilege Escalation vulnerabilities.

Nebula takes the participant through a variety of common (and less than common)
weaknesses and vulnerabilities in Linux. It takes a look at

 •SUID files
 •Permissions
 •Race conditions
 •Shell meta-variables
 •$PATH weaknesses
 •Scripting language weaknesses
 •Binary compilation failures 

At the end of Nebula, the user will have a reasonably thorough understanding
of local attacks against Linux systems, and a cursory look at some of the remote
attacks that are possible.

The fine guys there developed a course system using lessons, each lesson is accessible with a different username and password and each level is directed at a different attack vector.

You can reach further and grab Protostar (basic memory corruption) and Fusion (advanced memory corruption) training virtual-machines @ http://exploit-exercises.com/

5
  • Question: As someone security conscious (but not trying to attack systems) did you learn things from these sorts of exercises that you implemented to further protect your systems; or is it just teaching you how to attack poorly configured systems?
    – dr jimbob
    Nov 28, 2011 at 17:20
  • Read everything you can about security. It also definitely helps to attack. I mean obviously I'm not a professional but I find it much more helpful to actually do the security measures/attacks and read about them.
    – tpar44
    Nov 28, 2011 at 22:04
  • @drjimbob: That kind of exercies simulates a real-world scenario, not just reading off a paper. Of course, you will need to understand WHAT you are doing and not just HOW to do it in order to implement those tactics on a real server because it won't be EXACTLY the same and every system has it's own 'shticks'.
    – dalimama
    Nov 29, 2011 at 9:45
  • @dalimama: I agree doing exercises are better than being handed solutions. However, my question is as someone administering linux systems, did you learn anything from this that led you to make your systems more secure. I'm trying to decide whether or not to do these exercises, and while I'm sure people coding or reviewing secure programs need to understand these exploits, its not clear if every administrator does (presumably ubuntu devs make smart choices and patch exploits as they are found/announced if possible).
    – dr jimbob
    Nov 29, 2011 at 16:23
  • @drjimbob: In short, you don't have to go through full exploitation to be a security oriented administrator, it is an overshot after all, grab a good book and stick to best practices with a bit of common sense - that should do the trick sufficiently!
    – dalimama
    Nov 30, 2011 at 17:26
6

Well, the idea of a secure operating system is of course not to allow privilege escalation. So there needs to be an unpatched vulnerability. While privilege escalation vulnerability usually get less priority than remotely exploitable bugs, they do get fixed over time.

For example there was a vulnerability in the Linux Kernel that caused it to write core dump files of crashed applications into the current working directory without checking permissions. So an attacker could write a program that sets the working directory to for example /etc/cron.d and crash it. With a bit of preparation cron would be able to do something "useful" with the core dump file.

Another related attack is based on an insecure file creation vulnerability. A broken application may try to create a temporary file in a public writeable directory (e. g. /tmp) without forcing create-only. The attacker will create a symlink pointing elsewhere (where the attacker does not have write permission). The vulnerable application will overwrite the target file (e. g. /home/someuser/.profile for normal users and a system file for root).

I think two example are enough for now.

Taking a fully patched system and trying to exploit it, is not a good approach for learning about such issues. I recommend reading the Secure Programming for Linux and Unix HOWTO. Base on this knowledge you can play around: Write a simple application that violates one of those rules and then try to exploit it.

3

This is a very broad question, and is unsuited to the format of this site. I would advise looking on insecure.org or one of the other security advisory sites, where you will find examples such as http://seclists.org/bugtraq/2011/May/171 - which is actually from a Debian security advisory, but describes a number of linux issues including escalation of privilege.

You can search advisory lists for terms such as Ubuntu, Linux or Privilege.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .