Timeline for Privilege escalation in Linux 2.6.32
Current License: CC BY-SA 4.0
16 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 8, 2021 at 7:43 | comment | added | forest | Btw it's COW, not c0w. It stands for Copy-on-Write. | |
| Dec 21, 2018 at 5:33 | vote | accept | pignitulto | ||
| Dec 18, 2018 at 4:14 | vote | accept | pignitulto | ||
| Dec 21, 2018 at 5:33 | |||||
| Dec 18, 2018 at 4:13 | comment | added | pignitulto | In the contractual matter is, what worries me is that then something goes wrong (although it is in the contract). On the other hand, I will take your advice to do it with files that do not alter / etc / passwd and simply when I show you, I will try to show you that it is possible. Thank you very much for your time Forest, you are very kind! | |
| Dec 18, 2018 at 4:03 | comment | added | forest |
@pignitulto Any exploit has the potential of breaking the system. If you are doing penetration testing, they should write up a contract that tells you exactly what you can and cannot do. And by using cron scripts, I mean writing to them with DirtyCow to do something you want as root. For example, append the line chmod +s /bin/sed to a cronjob to get a backdoor in the form of a setuid sed.
|
|
| Dec 18, 2018 at 4:03 | comment | added | pignitulto | Oh, I got it, when I'm going to run dirtyc0w, right? (target_file and new_content) | |
| Dec 18, 2018 at 4:01 | comment | added | pignitulto | When you mean to use "cron scripts", what do you mean? I have the concept and I have handled cron, but I do not want to break the system and the client gets upset | |
| Dec 18, 2018 at 3:55 | comment | added | forest |
@pignitulto You should learn how DirtyCow works. You map a read-only file into memory and, if the exploit works, you are able to overwrite some of it. Consider using cron scripts as targets instead of the more obvious /etc/passwd, because the latter, if corrupted by the exploit, can break the system.
|
|
| Dec 18, 2018 at 3:53 | comment | added | pignitulto | I was reading the DirtyC0w code and apparently, it can be done in Python. What important call to the system could you try to verify that when you do this it works? | |
| Dec 18, 2018 at 3:34 | comment | added | forest | It would probably be possible if you can make syscalls directly. Do you know how DirtyCow works? If so, you should be able to do it. | |
| Dec 18, 2018 at 3:17 | comment | added | pignitulto | When you mentioned to me to do the Dirtyc0w exploit in python, is that possible? since in the end, from python I would have to make system calls and go back to the same point | |
| Dec 18, 2018 at 3:15 | comment | added | forest | @pignitulto I don't know your target well enough to say anything about that. Yes, it is complicated, but it is certainly possible to exploit the system. You will need to gain code execution (either by finding a directory you can execute binaries on) or by getting shellcode to run on some vulnerable program (not necessarily suid). From there, you can run e.g. DirtyCow. Just find a vulnerable program... | |
| Dec 18, 2018 at 3:14 | comment | added | pignitulto | I was thinking about showing the client the escalation of privileges, but I am seeing that it is complicated. Is it possible that when doing Symlink, take the other web pages?. Edit: One of my goals was to be able to show him that in / home he could access his websites. But since I do not have root | |
| Dec 18, 2018 at 3:11 | comment | added | forest | @pignitulto What is your current goal, to execute machine code? | |
| Dec 18, 2018 at 3:11 | comment | added | pignitulto | I was reviewing the files that are with SUID, but nothing I can do. There is a "mount" that has SUID but the problem is that I could not mount something with / bin / bash because not even in "/ tmp" I have privileges. Does it affect something that is a shared hosting? Could I do symlink? | |
| Dec 18, 2018 at 1:49 | history | answered | forest | CC BY-SA 4.0 |