1

Consider the following Linux system:

  • root account is disabled (passwd -l root, passwd -d root),
  • there is an account 'admin', with sudo rights,
  • there is an account 'webservice', with limited privileges, and no sudo rights,
  • su is disabled via PAM (auth required pam_wheel.so),
  • only 'admin' can SSH into the system (AllowUsers directive, only with a key, no password accepted),
  • 'webservice' runs some web services which has been compromised: an attacker can now run remotely any shell command as the user 'webservice',
  • the attacker has no physical access to the device,
  • finally, the attacker knows the 'admin' password, but not admin's SSH key

How could the attacker run a command as 'admin'?

My understanding is that the attacker cannot sudo, cannot su, cannot SSH, even if the admin password is known, so no privilege escalation is possible. Is that correct? My objective is to understand the consequences and the possible mitigation (if any) of having an admin password compromised.

2
  • 1
    You explained that su and sudo are both disabled, fine. You also pretend that the attacker already connected as user webservice cannot use ssh but why? Mar 19, 2021 at 16:03
  • @SergeBallesta The attacker is assumed to not know admin's SSH key (I've edited the post), and SSH is set up to refuse an authentication with password only
    – nbedou
    Mar 19, 2021 at 16:13

1 Answer 1

1

You should make sure that no other service allow login with username and password. Some systems have an active telnetd or ftpd by default. Ftp would be enough because it would allow to overwrite admin's authorized_keys file.

You should also control that exec login is not possible in your system from a simple shell.

Finally you should control that webservice is not allowed to write files in any directory where admin or root could try to execute files (the dangerous . in PATH for example).

Those are just the first possible vulnerabilities I could think of. Do not hope that list to be exhaustive...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.