5

Nessus, when running a credentialed scan can check patch levels and return vulnerabilities when a package is one that hasn't been updated to the latest, non-vulnerable version.

What is a good way of doing this to look for privilege escalation vulnerabilities - say when you get shell access to a server under a limited user account, but want to elevate to that of root?

Commands such as dkpg --list can be used on Ubuntu in order to enumerate patch levels. However, this is very much a manual, time consuming task.

Are there any approaches that can speed up privilege escalation on a Linux host? Two techniques that are useful are running scripts such as unix-privesc-check and linuxprivchecker.py. However, they don't automatically check the patch level as described above. The latter does in a fashion, but I believe it only does some basic checks and as it is not maintained it is not as useful against more up to date hosts.

Other thoughts that I've had is to run some type of binary that would effectively run an SSH server on a non privileged port, protected with my own credentials rather than those of the host machine. This would enable Nessus to complete a credentialed scan of the machine.

  • I am not sure to understand what you are asking: is it how to filter out vulnerabilities which can be exploited towards a privilege escalation (first 4 paragraphs of your question) or how to setup your system for credentialed checks (last paragraph - note that you will need to log in as a administrative user) – WoJ Oct 2 '15 at 15:11
  • 1
    The former. That's not true regarding credentialed checks by Nessus - some checks can be done without elevation. – SilverlightFox Oct 2 '15 at 15:15
  • True, it depends on the OS and on the check. – WoJ Oct 2 '15 at 15:17
  • 1
    Which is where my last paragraph was going. If there was a way to run Nessus against some type of shell (or meterpreter session) in order for it to do a lot of the stuff that credentialed scanning can do. – SilverlightFox Oct 2 '15 at 15:19
  • For Windows, Metasploit has post/windows/gather/enum_patches. I don't know of one for Linux :( – paj28 Oct 2 '15 at 16:29
0

Nessus, surprisingly at times, often comes up with results you would never expect in both good and bad ways. Be sure you are configuring it correctly -- credentialed scans can be hard to get right.

OpenVAS has a lot of checks that Nessus does not and works in a very similar way. However, Nessus does have a ton of checks. It may be OS or environment dependent for best results, so run both.

CVEDetails is a great source, where you can narrow down into specific product, version, et al. It will often link out to other, often original resources -- or sometimes spell out a specific exploit or Metasploit module (e.g., use .*linux/gather/enum <tab>, <tab> <tab>). If it doesn't then search for the vulnerability name, CVE with number, patch number or level, or other associated information on exploitsearch.net. I grab a lot of shells or even get ideas for new privilege escalation exploits by querying these two websites daily.

Many other tools could be helpful depending on perspective. Is anything running on any local network ports? Can NeXpose or Nmap identify those ports? What about IPC or pipes? The vulscan NSE script also provides wonderful direction beyond even the default (-sC) and deeper NSE planning, configuration, and analysis. Packet analysis (e.g., pyshark provides a programmatic interface) may also be of use here. There are tons of NSE scripts for a variety of target platforms available third-party on GitHub and perhaps other places. You may need to create your own NSE scripts on occasion. Mapping known ports or services from Nmap to Metasploit is most easily accomplished with a tool or technique such as metasploitHelper.

I would caution using tools such as linuxprivchecker.py, Linux_Exploit_Suggester, linux-exp-suggester, or the various kernel exploits you find from other means. One of the primary cautions you should be aware of is SMEP. More about SMEP can be found in one of the answers on this exact forum, including how to query for it. It can be disabled at boot with a grub parameter of `nosmep' or by using an LKM. If SMEP is enabled, running kernel exploits without modification may cause a kernel panic, which means it will crash the system.

There are many ways to escalate privilege besides CVEs. Before I move on from the topic, you may find that cloning (N.B., as close as possible if you do not know all of the details) the target into your own controlled environment can allow you to run as root in order to understand your target better. Tools such as cvechecker may be incredibly useful in these cloned environments, as well as rerunning your Nessus, OpenVAS, and perhaps even CIS-CAT or ovaldi checks.

Some tools, such as LinEnum, shine whether run as root or as a less-privileged user, perhaps similarly to unix-privesc-check. I have received a lot of help from the use of these tools in a variety of environments -- cloned or owned. I have seen a few custom scripts (mostly for the PWK labs from Offensive Security) that work like these, but it is also worth it to mention unprivileged host-enumeration scripts that target hardening such as Lynis, Bastille, and LSAT / USAT. For another comprehensive list of OS-default commands, external tools, and techniques, be sure to check out -- https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/

For target environments where there are password-protected root and other "live" accounts, there may be many ways to attack the identity and trust relationships in order to steal credentials. A lot of privilege escalation (and I say that this has been true over the past 50 years of computer use and abuse) is about guessing relationships (e.g., known_hosts, authorized_keys2, hosts.equiv, et al), cracking passwords (e.g., hashes), brute-forcing login, remote (e.g., ssh keys), or su/sudo prompts, etc. There are many tools that perform or aid in these tasks on Kali Linux and elsewhere. So many techniques have been developed, even in recent years. Two you should definitely be aware of are sucrack and phrasendrescher.

The key thing about passwords is reuse. If you find any file, service, or configurable on a system (or nearby system, such as on the same network -- perhaps even extending much further such as a particular user's favorite password found from an already-existing credential dump such as the Adobe, RockYou, Gawker, and others found in tools such as recon-ng) and it has a password, then you should try that password everywhere you can, especially if it makes logical sense to do so. No tool can do this for you, but many can help change things up a bit. Many just provide straight-up password recovery. Recover one password for one user and you may find a path all the way to the top. In Kali Linux, the pack project is a great starting point, with tools such as dictstat, maskgen, and policygen. John and Hashcat reign supreme, especially with integrations to other tools (e.g., metasploit-framework, LAIR-framework, KvasirSecurity), and extensions such as statsprocessor. On a network where the real action is happening, you may be able to pick up tons of cleartext, weak-encryption, or scenario-driven (i.e., MITM condition) credentials. Tools in this space are easy-creds and PCredz, perhaps even better when combined with metasploit-framework modules such as the ones under the auxiliary/server and auxiliary/spoof hierarchies. Credentials can also be acquired via social engineering techniques -- let's not forget the basics with tools such as SET, et al.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.