2

While conducting a pentest on a Linux machine, I have a limited shell and trying to escalate privileges.

One interesting thing that i have found is a binary called connect installed under /usr/local/bin/ that has SUID permissions. Here is the complete output for ls -al:

mark@serv1:/usr/local/bin$ ls -al connect -rwsr-xr-x 1 root root 6723 2013-10-10 13:02 connect

When trying to run this binary, it seems that it is trying to connect to an ssh server. here is the output.

mark@serv1:/usr/local/bin$ ./connect Connecting to x.x.x.x ssh: connect to host x.x.x.x port 22: Network is unreachable lost connection

I am really wondering is there is a way to leverage this to get a root access to the system ? I though that I could utilize this to get a shell of this SUID binary or even trying to ssh root@127.0.0.1 utilizing these permissions. However, I can not figure out how to accomplish this since I am not that much Linux expert.

Thanks

  • 2
    strings connect | less might help, and file connect to get the type. maybe it is just a script you could read. – that guy from over there Oct 25 '13 at 20:38
  • Thanks, Actually that was a nice trick although it did not help getting a full root. however, It just turned out that the command that this script runs is "scp -r /tobecopied/* x.x.x.x:/var/www/" and the file type is: " setuid ELF 32-bit LSB executable" – Ahmed Taher Oct 25 '13 at 23:29
9

If may be vulnerable because it runs the ssh binary without specifying the full path. To test this:

  1. Copy bash into a file called ssh in your home directory.
  2. Set PATH to include your home directory at the beginning.
  3. Try running connect. If it's vulnerable, you will get a root shell.
  • Thanks..I have just edited my last comment as I was mistaken. as @that guy from over there advised to run strings against the binary which revealed that it is using "scp" to connect to the remote server. Thus, I have applied the above instructions against "scp" instead of "ssh". But I get this error "scp: /tobecopied/*: No such file or directory" – Ahmed Taher Oct 26 '13 at 0:06
  • I searched out and seems the problem with copied /bin/bash. I even tried /bin/sh but no luck. what other binaries that can be renamed to scp safely and still give me access to shell instead of normal shells? – Ahmed Taher Oct 26 '13 at 1:19
  • 1
    @AhmedTaher You could write your own quick and dirty shell script that just ignores the arguments and forks a shell. – Michael Hampton Oct 26 '13 at 1:53
  • 2
    @MichaelHampton I was just thinking of already compiled binaries on the system that could do the job. anway, I tried metasploit reverse payload binary and it worked for me. Thanks guys for the hep – Ahmed Taher Oct 26 '13 at 1:56
  • @AhmedTaher I might be facing the same machine but again just getting scp: file/tobecopied/*: No such file or directory. What msfvenom payload did you use? – Belial Dec 4 '17 at 17:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.