1

I am in an audit and I need to show the client that privileges can be scaled but I have tried in various ways and I could not. The Kernel version is 2.6.32-754.3.5.el6.x86_64.

I have already tried using DirtyCOW, but the problem is that I always get "sh: denied permissions". And in fact, gcc also has root only permissions.

I'm a user without privileges.

2

I'll go out on a limb and guess that any directory your user has permission to write to is mounted as noexec, which means that you will not be able to directly execute anything. To run a shell script despite this, you can always do bash script.sh if doing ./script.sh fails with a permission denied error. You should try looking for any directory you can write to which you can also execute from. If none exist, then even having gcc would not help you, since you could not execute the code it generates.

In order to exploit DirtyCow, you need to invoke a number of system calls. This cannot be done from within a shell script. You either need to use a sufficiently sophisticated scripting language such as Python and re-write the exploit in it, or you need to compromise a binary that you have the rights to run and make it run shellcode to perform the attack. If you aren't able to do that, I suggest you practice binary exploitation and shellcode development first to learn how, or this will be quite hard.

  • I was reviewing the files that are with SUID, but nothing I can do. There is a "mount" that has SUID but the problem is that I could not mount something with / bin / bash because not even in "/ tmp" I have privileges. Does it affect something that is a shared hosting? Could I do symlink? – pignitulto Dec 18 '18 at 3:11
  • @pignitulto What is your current goal, to execute machine code? – forest Dec 18 '18 at 3:11
  • I was thinking about showing the client the escalation of privileges, but I am seeing that it is complicated. Is it possible that when doing Symlink, take the other web pages?. Edit: One of my goals was to be able to show him that in / home he could access his websites. But since I do not have root – pignitulto Dec 18 '18 at 3:14
  • @pignitulto I don't know your target well enough to say anything about that. Yes, it is complicated, but it is certainly possible to exploit the system. You will need to gain code execution (either by finding a directory you can execute binaries on) or by getting shellcode to run on some vulnerable program (not necessarily suid). From there, you can run e.g. DirtyCow. Just find a vulnerable program... – forest Dec 18 '18 at 3:15
  • 1
    @pignitulto Any exploit has the potential of breaking the system. If you are doing penetration testing, they should write up a contract that tells you exactly what you can and cannot do. And by using cron scripts, I mean writing to them with DirtyCow to do something you want as root. For example, append the line chmod +s /bin/sed to a cronjob to get a backdoor in the form of a setuid sed. – forest Dec 18 '18 at 4:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.