Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am trying to learn how an attacker can escalate privileges in Ubuntu 10.04. I have heard that this can be done but no one has ever said how to do it. The best defense is knowing how it is done and doing it yourself. So to find out, I set up a computer running Ubuntu 10.04, linux kernel 2.36 I am having an awfully hard time doing this when the the shell being used is not root. I was wondering if anyone had a way of doing this because for a 2 weeks I have not been able to figure it out. Again, I am not breaking into a production system, just an extra machine that I have. If anyone could help me learn this, I would appreciate it. Thanks!

share|improve this question
3  
If you can on-site reboot the system and aren't encrypting the hd, its trivial to boot into single user mode and do things as root without knowing any password. cyberciti.biz/faq/howto-boot-ubuntu-linux-rescue-mode (This isn't really privilege escalation; but users should be aware of this.) –  dr jimbob Nov 28 '11 at 17:08
    
yea thanks though. It won't work remotely though... –  tpar44 Nov 28 '11 at 22:05
    
Try this one. sprunge.us/hfAJ It works on 10.10 too if you haven't upgraded your kernel. –  shadyabhi Dec 2 '11 at 17:36

3 Answers 3

up vote 9 down vote accepted

There is a training ground just for your purpose:

Nebula 2 is a complete linux distribution (virtual machine) for learning purposes to perform many Privilege Escalation vulnerabilities.

Nebula takes the participant through a variety of common (and less than common)
weaknesses and vulnerabilities in Linux. It takes a look at

 •SUID files
 •Permissions
 •Race conditions
 •Shell meta-variables
 •$PATH weaknesses
 •Scripting language weaknesses
 •Binary compilation failures 

At the end of Nebula, the user will have a reasonably thorough understanding
of local attacks against Linux systems, and a cursory look at some of the remote
attacks that are possible.

The fine guys there developed a course system using lessons, each lesson is accessible with a different username and password and each level is directed at a different attack vector.

You can reach further and grab Protostar (basic memory corruption) and Fusion (advanced memory corruption) training virtual-machines @ http://exploit-exercises.com/

share|improve this answer
    
Question: As someone security conscious (but not trying to attack systems) did you learn things from these sorts of exercises that you implemented to further protect your systems; or is it just teaching you how to attack poorly configured systems? –  dr jimbob Nov 28 '11 at 17:20
    
Read everything you can about security. It also definitely helps to attack. I mean obviously I'm not a professional but I find it much more helpful to actually do the security measures/attacks and read about them. –  tpar44 Nov 28 '11 at 22:04
    
@drjimbob: That kind of exercies simulates a real-world scenario, not just reading off a paper. Of course, you will need to understand WHAT you are doing and not just HOW to do it in order to implement those tactics on a real server because it won't be EXACTLY the same and every system has it's own 'shticks'. –  dalimama Nov 29 '11 at 9:45
    
@dalimama: I agree doing exercises are better than being handed solutions. However, my question is as someone administering linux systems, did you learn anything from this that led you to make your systems more secure. I'm trying to decide whether or not to do these exercises, and while I'm sure people coding or reviewing secure programs need to understand these exploits, its not clear if every administrator does (presumably ubuntu devs make smart choices and patch exploits as they are found/announced if possible). –  dr jimbob Nov 29 '11 at 16:23
    
@drjimbob: In short, you don't have to go through full exploitation to be a security oriented administrator, it is an overshot after all, grab a good book and stick to best practices with a bit of common sense - that should do the trick sufficiently! –  dalimama Nov 30 '11 at 17:26

Well, the idea of a secure operating system is of course not to allow privilege escalation. So there needs to be an unpatched vulnerability. While privilege escalation vulnerability usually get less priority than remotely exploitable bugs, they do get fixed over time.

For example there was a vulnerability in the Linux Kernel that caused it to write core dump files of crashed applications into the current working directory without checking permissions. So an attacker could write a program that sets the working directory to for example /etc/cron.d and crash it. With a bit of preparation cron would be able to do something "useful" with the core dump file.

Another related attack is based on an insecure file creation vulnerability. A broken application may try to create a temporary file in a public writeable directory (e. g. /tmp) without forcing create-only. The attacker will create a symlink pointing elsewhere (where the attacker does not have write permission). The vulnerable application will overwrite the target file (e. g. /home/someuser/.profile for normal users and a system file for root).

I think two example are enough for now.

Taking a fully patched system and trying to exploit it, is not a good approach for learning about such issues. I recommend reading the Secure Programming for Linux and Unix HOWTO. Base on this knowledge you can play around: Write a simple application that violates one of those rules and then try to exploit it.

share|improve this answer

This is a very broad question, and is unsuited to the format of this site. I would advise looking on insecure.org or one of the other security advisory sites, where you will find examples such as http://seclists.org/bugtraq/2011/May/171 - which is actually from a Debian security advisory, but describes a number of linux issues including escalation of privilege.

You can search advisory lists for terms such as Ubuntu, Linux or Privilege.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.