1

I am in an audit and I need to show the client that privileges can be scaled but I have tried in various ways and I could not. The Kernel version is 2.6.32-754.3.5.el6.x86_64.

I have already tried using DirtyCOW, but the problem is that I always get "sh: denied permissions". And in fact, gcc also has root only permissions.

I'm a user without privileges.

0

1 Answer 1

2

I'll go out on a limb and guess that any directory your user has permission to write to is mounted as noexec, which means that you will not be able to directly execute anything. To run a shell script despite this, you can always do bash script.sh if doing ./script.sh fails with a permission denied error. You should try looking for any directory you can write to which you can also execute from. If none exist, then even having gcc would not help you, since you could not execute the code it generates.

In order to exploit DirtyCow, you need to invoke a number of system calls. This cannot be done from within a shell script. You either need to use a sufficiently sophisticated scripting language such as Python and re-write the exploit in it, or you need to compromise a binary that you have the rights to run and make it run shellcode to perform the attack. If you aren't able to do that, I suggest you practice binary exploitation and shellcode development first to learn how, or this will be quite hard.

13
  • I was reviewing the files that are with SUID, but nothing I can do. There is a "mount" that has SUID but the problem is that I could not mount something with / bin / bash because not even in "/ tmp" I have privileges. Does it affect something that is a shared hosting? Could I do symlink?
    – pignitulto
    Commented Dec 18, 2018 at 3:11
  • @pignitulto What is your current goal, to execute machine code?
    – forest
    Commented Dec 18, 2018 at 3:11
  • I was thinking about showing the client the escalation of privileges, but I am seeing that it is complicated. Is it possible that when doing Symlink, take the other web pages?. Edit: One of my goals was to be able to show him that in / home he could access his websites. But since I do not have root
    – pignitulto
    Commented Dec 18, 2018 at 3:14
  • @pignitulto I don't know your target well enough to say anything about that. Yes, it is complicated, but it is certainly possible to exploit the system. You will need to gain code execution (either by finding a directory you can execute binaries on) or by getting shellcode to run on some vulnerable program (not necessarily suid). From there, you can run e.g. DirtyCow. Just find a vulnerable program...
    – forest
    Commented Dec 18, 2018 at 3:15
  • 1
    @pignitulto Any exploit has the potential of breaking the system. If you are doing penetration testing, they should write up a contract that tells you exactly what you can and cannot do. And by using cron scripts, I mean writing to them with DirtyCow to do something you want as root. For example, append the line chmod +s /bin/sed to a cronjob to get a backdoor in the form of a setuid sed.
    – forest
    Commented Dec 18, 2018 at 4:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .