6

I've been battling with one school task for a couple of days and can't seem to find any idea how to solve it. The task is pretty simple:

On the server there is a secret.txt file in the /root folder, which is owned by root. The task is to read the contents of this file, which contains the answer. To solve the task, use one of the programs with SUID privileges to access the root account.

First I check which programs do have SUID privileges by using command find / -perm /4000 which returns these programs:

/usr/bin/chfn
/usr/bin/umount
/usr/bin/passwd
/usr/bin/mount
/usr/bin/chsh
/usr/bin/date
/usr/bin/gpasswd
/usr/bin/newgrp
/usr/bin/procmail
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/sbin/sensible-mda

And I don't have any idea how to proceed with it.

Is there any way to use procmail to read the file while sendmail or mail don't have the privileges? I've tried to send a mail to myself with the file attached but every time I either had to use some sort of basic Linux command like cp or cat inside .procmailrc which resulted in Permission Denied, or had to use sendmail or mail which don't have the privileges for the file. Of course I don't have sudo rights. I'm just completely out of ideas on this one.

10
  • 3
    What did the class train you to do? What process have you been given to follow?
    – schroeder
    Nov 17, 2023 at 10:29
  • 1
    what other programs there can read files?
    – schroeder
    Nov 17, 2023 at 10:59
  • 10
    @Paul I dunno, setuid date and sensible-mda seem suspicious to me...
    – marcelm
    Nov 17, 2023 at 18:36
  • 1
    date is not normally a SUID tool, that makes it stand out in your list.
    – Criggie
    Nov 19, 2023 at 23:36
  • 1
    Do you happen to have write permissions to any of these files? (Asking the simple questions) Nov 20, 2023 at 6:30

3 Answers 3

19

There is a very useful site called GTFOBins that has details about lots of different *NIX binaries, and how they can be used to privesc or perform various other actions. Going through the list of SUID binaries you have on the system and seeing if any of them have SUID entries on that site would be a good starting point, and might give you some ideas. Lots of binaries have rarely-used options that can perform actions you might not expect them to, so it can save a lot of time compared to reading through all of their manpages looking for things to try.

Otherwise, you need to look at the binaries themselves, and see if they have any functionality that you might be able to use to read files (or whatever it is that you're trying to do). Since most common binaries are likely to be included in sites like GTFOBins, if you don't find anything there then it's often good to start by looking at any more obscure or custom binaries.

13

There's a fairly well-known exploit on chfn: https://github.com/advisories/GHSA-5896-67mw-rv4j

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

1
  • This will depend on the version, and exploits were not yet part of the process. The class was getting them to use processes that could access files.
    – schroeder
    Nov 18, 2023 at 10:22
10

Among those binaries, that date is setuid seems very suspicious, as spotted by marcelm

If you look at the options supported by date, it has a -f option which displays the time described by each line of the file.

Thus, if you run date -f /root/secret.txt it will open /root/secret.txt (since date is setuid) and will probably output an error for each line:

$ date -f /root/secret.txt 
date: invalid date ‘Secret answer’
date: invalid date ‘Another secret line’

Note that if any of the lines is parseable as a date by the program (for example, certain numeric lines would be interpreted as a time or date), then the output will be a date, and you would need to figure out what the initial line was.

1
  • 21
    You kinda did their homework for them. Both marcelm and I were nudging them in a direction. You provided a PoC. You provided an answer, not a method/process/mental model. Using Gh0stFish's link date -fwould be discovered.
    – schroeder
    Nov 18, 2023 at 10:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .