Escalating user privileges on Linux

Question

I've been battling with one school task for a couple of days and can't seem to find any idea how to solve it. The task is pretty simple:

On the server there is a secret.txt file in the /root folder, which is owned by root. The task is to read the contents of this file, which contains the answer. To solve the task, use one of the programs with SUID privileges to access the root account.

First I check which programs do have SUID privileges by using command find / -perm /4000 which returns these programs:

/usr/bin/chfn
/usr/bin/umount
/usr/bin/passwd
/usr/bin/mount
/usr/bin/chsh
/usr/bin/date
/usr/bin/gpasswd
/usr/bin/newgrp
/usr/bin/procmail
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/sbin/sensible-mda

And I don't have any idea how to proceed with it.

Is there any way to use procmail to read the file while sendmail or mail don't have the privileges? I've tried to send a mail to myself with the file attached but every time I either had to use some sort of basic Linux command like cp or cat inside .procmailrc which resulted in Permission Denied, or had to use sendmail or mail which don't have the privileges for the file. Of course I don't have sudo rights. I'm just completely out of ideas on this one.

Answer 1

There is a very useful site called GTFOBins that has details about lots of different *NIX binaries, and how they can be used to privesc or perform various other actions. Going through the list of SUID binaries you have on the system and seeing if any of them have SUID entries on that site would be a good starting point, and might give you some ideas. Lots of binaries have rarely-used options that can perform actions you might not expect them to, so it can save a lot of time compared to reading through all of their manpages looking for things to try.

Otherwise, you need to look at the binaries themselves, and see if they have any functionality that you might be able to use to read files (or whatever it is that you're trying to do). Since most common binaries are likely to be included in sites like GTFOBins, if you don't find anything there then it's often good to start by looking at any more obscure or custom binaries.

Answer 2

There's a fairly well-known exploit on chfn: https://github.com/advisories/GHSA-5896-67mw-rv4j

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

Answer 3

Among those binaries, that date is setuid seems very suspicious, as spotted by marcelm

If you look at the options supported by date, it has a -f option which displays the time described by each line of the file.

Thus, if you run date -f /root/secret.txt it will open /root/secret.txt (since date is setuid) and will probably output an error for each line:

$ date -f /root/secret.txt 
date: invalid date ‘Secret answer’
date: invalid date ‘Another secret line’

Note that if any of the lines is parseable as a date by the program (for example, certain numeric lines would be interpreted as a time or date), then the output will be a date, and you would need to figure out what the initial line was.