I'm working on a college assignment where we were given a system and asked to exploit it. I was given a Fedora 13 Goddard running Linux kernel, and my task is to gain root privileges on the system and report the vulnerability which was exploited. We are free to borrow online help too. The problem is that I have been searching for a while, but couldn't find any exploit that can grant root privileges. I tried various exploits from packet storm, exploit DB and others, the best I can get is a DoS. I've seen the CVE databases, and I've found few vulnerabilities detailed, but can't find any exploit code anywhere. I'd be really glad if someone can help me out with this. Thanks in advance.

  • 4
    what else is running on the system: you are focused only on the kernel version – schroeder Oct 9 '17 at 16:22
  • Is the assignment to gain root privileges remotely, or do you have local non-root access? I assume you have local access, otherwise you wouldn't necessarily know the kernel and distro details. As Schroeder has hinted, any service running as root can be used, and that is often where the vulnerabilities are found. Also, it wouldn't be wrong to also explore social engineering avenues, because that is REALLY where the weak links in the chain are found in any organization. Call your university help desk and lie and manipulate as needed to get them to give root access. – Thomas Carlisle Oct 9 '17 at 18:00
  • @Thomas Carlisle. I have remote access to the instance via SSH. Social engineering can be done, but this is rather an assignment under exploit development class. So that's why I didn't attempt that yet. – user148898 Oct 9 '17 at 20:03
  • @schroeder .. I used nmap and determined FTP, SSH, HTTP and a few more services running. I tried looking up their vulnerabilities as well, but like I said, I could find the CVEs but no PoC code. That's where I'm struggling. – user148898 Oct 9 '17 at 20:04
  • 1
    If the class itself is for learning how to develop exploits, doesn't using pre-existing exploits kind of defeat the purpose? You may want to use some of those CVEs you found to develop your own exploits. Are there any cron jobs set to run with root privileges? Do those cron jobs read from a file which you have read/write access to? Are any of those services running as root? – Dan Landberg Oct 9 '17 at 21:07

Look for when the last patch was applied, and then look for Linux privilege escalation vulnerabilities that are not patched. Most of the Linux privilege escalation vulnerabilities affect multiple distros.

In this case, Linux kernel seems very old, so public exploits such as "dirty cow" (CVE-2016-5195) may work.

Other methods may involve brute forcing the admin password.


|improve this answer|||||

Not the answer you're looking for? Browse other questions tagged or ask your own question.