3

As www-data user (non-privileged user) I have found this SUID, world-writable shell script:

www-data@Cisco:/home/cripto$ ls -al /etc/init.d/admin
-rwsr-xrwx 1 root bob 233 Nov 12 13:09 /etc/init.d/admin

It's part of a CTF machine. The content is trivial, it does nothing useful at all (it seems like it is only a boilerplate template):

#!/bin/sh
# /etc/init.d/admin


case "$1" in
   start)
    echo "[i] Start admin Area"


    ;;
   stop)
    echo "[i] Stop admin Area"

        ;;
   *)
    echo "Usage: /etc/init.d/admin {start|stop}"
    exit 1
    ;;  
esac
exit 0

But I suspect that this script could help me to elevate my privileges. I have been reading about it here:

Dangers of SUID Shell Scripts

and here

Exploiting init.d for Fun and Profit

But:

  • The machine can't be rebooted (that was my first idea, editing the script so that it creates a privileged shell in /tmp and forcing a reboot)
  • The positional parameter $1 seems to be non-injectable (I tried to fool the case "$1" passing different arguments from command line, like ./admin "hi; id" and similar things, to no avail)

I wonder if there are some environment variables that I could exploit. Or some kind of tampering that I could force manipulating the IFS variable. Any ideas about how this kind of SUID scripts could be exploitable?

5
  • It's world writable and world executable, so why don't you write your own payload into it and execute it? (And don't use a shell script, shell scripts don't really work with suid) – Johannes Kuhn Jan 24 '18 at 9:46
  • When I edit the file (with vi in this case, but I think that it doesn't matter) its SUID bit is lost. I have reproduced this behavior in another Linux machine /tmp$ id uid=1009(edu) gid=1010(edu) groups=1010(edu) /tmp$ ls -al admin -rwsr-xrwx 1 root root 249 Jan 24 11:46 admin /tmp$ vi admin /tmp$ ls -al admin -rwxr-xrwx 1 root root 236 Jan 24 11:50 admin – Juanan Jan 24 '18 at 10:50
  • 1
    Related: SUID bit is unset after file modification – Juanan Jan 24 '18 at 11:00
  • 2
    Is this Linux? On Linux, shell scripts will not obey the suid bit. You can make a script suid all you want but nothing will come of it. – forest Jan 24 '18 at 14:24
  • Yes, it was a Linux machine. Reading the write-up I realised that this script was a red-herring. – Juanan Feb 14 '18 at 9:07
-1

Multiple things can be done to this file to help you get further. By change can you do the following add to the file the following

echo '#!/bin/sh'|tee admin && echo 'chattr -i /home/(your user)/(file of your chosing)'|tee -a admin

echo 'chown root:root /home/(Your User)/(file you create)' | tee -a admin && echo 'chmod 4755 /home/(your user)/(Your file)'|tee -a admin

Then on your user home directory create a simple c file to setgid and setguid. Compile to the name listed in the script above and then reboot. This will run the file and change the owner to root with guid set.

Then it's simple ./file and then fun.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.