4

While conducting a pentest on a Linux machine, I have a limited shell and trying to escalate privileges.

One interesting thing that i have found is a binary called connect installed under /usr/local/bin/ that has SUID permissions. Here is the complete output for ls -al:

mark@serv1:/usr/local/bin$ ls -al connect -rwsr-xr-x 1 root root 6723 2013-10-10 13:02 connect

When trying to run this binary, it seems that it is trying to connect to an ssh server. here is the output.

mark@serv1:/usr/local/bin$ ./connect Connecting to x.x.x.x ssh: connect to host x.x.x.x port 22: Network is unreachable lost connection

I am really wondering is there is a way to leverage this to get a root access to the system ? I though that I could utilize this to get a shell of this SUID binary or even trying to ssh [email protected] utilizing these permissions. However, I can not figure out how to accomplish this since I am not that much Linux expert.

Thanks

Improve this question
2
  • 2
    strings connect | less might help, and file connect to get the type. maybe it is just a script you could read.
    – that guy from over there
    Oct 25, 2013 at 20:38
  • Thanks, Actually that was a nice trick although it did not help getting a full root. however, It just turned out that the command that this script runs is "scp -r /tobecopied/* x.x.x.x:/var/www/" and the file type is: " setuid ELF 32-bit LSB executable"
    – Ahmed Taher
    Oct 25, 2013 at 23:29

1 Answer 1

Reset to default
12

If may be vulnerable because it runs the ssh binary without specifying the full path. To test this:

  1. Copy bash into a file called ssh in your home directory.
  2. Set PATH to include your home directory at the beginning.
  3. Try running connect. If it's vulnerable, you will get a root shell.
Improve this answer
5
  • 1
    Thanks..I have just edited my last comment as I was mistaken. as @that guy from over there advised to run strings against the binary which revealed that it is using "scp" to connect to the remote server. Thus, I have applied the above instructions against "scp" instead of "ssh". But I get this error "scp: /tobecopied/*: No such file or directory"
    – Ahmed Taher
    Oct 26, 2013 at 0:06
  • I searched out and seems the problem with copied /bin/bash. I even tried /bin/sh but no luck. what other binaries that can be renamed to scp safely and still give me access to shell instead of normal shells?
    – Ahmed Taher
    Oct 26, 2013 at 1:19
  • 2
    @AhmedTaher You could write your own quick and dirty shell script that just ignores the arguments and forks a shell.
    – Michael Hampton
    Oct 26, 2013 at 1:53
  • 2
    @MichaelHampton I was just thinking of already compiled binaries on the system that could do the job. anway, I tried metasploit reverse payload binary and it worked for me. Thanks guys for the hep
    – Ahmed Taher
    Oct 26, 2013 at 1:56
  • @AhmedTaher I might be facing the same machine but again just getting scp: file/tobecopied/*: No such file or directory. What msfvenom payload did you use?
    – Belial
    Dec 4, 2017 at 17:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .