Questions tagged [privilege-escalation]

Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access throughout the environment

Filter by
Sorted by
Tagged with
0
votes
1answer
36 views

Can a process executed as Root do ring 0 stuff?

I know that ring 0 is a CPU concept, but are processes running as root allowed to run instructions that require ring 0 such as changing the cr3 register for the page table ?
2
votes
1answer
75 views

Why is sudo's usage of timestamp files insecure?

Sudo and Opendoas on Linux use timestamp files to keep track of how long it's been since you've last entered your password. Doas on BSD uses a kernel feature instead. Why is the latter considered more ...
0
votes
1answer
120 views

Understanding the Meltdown vulnerability

I need to write a simple program that demonstrates a race condition. I picked the Meltdown vulnerability. I want to clarify something. I'm following this explanation https://resources.infosecinstitute....
1
vote
0answers
51 views

Authorise access to hierarchical data

Consider a scenario in which you offer service access based on a hierarchy of authority. i.e., a HEAD can register his subordinates. The authenticated HEAD has the previledge to read and update data ...
3
votes
1answer
239 views

If browsing the web with root is dangerous, isn't browsing the web with a sudo enabled account only marginally safer?

If I get hit with malware while performing daily tasks (e.g. - checking email, web browsing, etc.) with a root shell, the malware will own my machine. If the aforementioned occurs whilst on a standard ...
-1
votes
1answer
110 views

PowerShell - privilege escalation [closed]

In the past, I have used the Sherlock PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities. However, I am looking for a similar script, but I ...
1
vote
1answer
166 views

Secure way to run a linux binary which needs access to ressources only available to root?

As a developer, I ask how to approach security concerns regarding permissions of a binary which needs access to resources only available to root users. For example, let's think of a simple tool which ...
0
votes
0answers
100 views

Sudo -l systemctl bypass

I am trying to privilege escalate a vulnerable box and I've stuck with this output: sudo -l Matching Defaults entries for charlie on sewers: env_reset, mail_badpass, secure_path=/usr/local/...
1
vote
1answer
125 views

SUID Priv Escalation - LD_LIBRARY_PATH versus ldconfig and /etc/ld.so.conf

Background Currently doing some vulnservers on Offensive Security's Proving Grounds Practice Labs. A vulnserver is a machine configured with vulnerabilities for testing/audit and research purposes. I ...
2
votes
1answer
73 views

How to fine tune timing for CVE-2021-3156 (sudo privilege escalation)?

I am trying to execute the sudo buffer overflow (CVE-2021-3156) on one of my systems, but haven't got it working yet. The system is definitely vulnerable (taking into account sudo version and sudoedit ...
1
vote
0answers
81 views

Spawning child processes from root using runuser command

I am working as an intern for an online coding platform startup (similar to LeetCode or HackerRank). The backend is written in Nodejs. Instead of running the code in a sandbox of some sort, the lead ...
0
votes
2answers
201 views

Is there a way to change your current UID to equal your EUID?

Here is the scenario: running id gives this : uid=1001(test1) gid=1001(test1) euid=1000(bl4ckc4t) groups=1001(test1) - This means that I am user test1, but my euid is set to another user. My goal is ...
0
votes
1answer
171 views

Privilege escalation using symlink [closed]

I am working on a "Hack me" challenge, I have access to apache account in the server, I tried to get root access, I run linpeas.sh script and linpeas didn't find anything special, however, ...
1
vote
1answer
282 views

How to run PrintSpoofer in memory from powershell?

PrintSpoofer uses named pipe impersonation to elevate on Windows 10 to SYSTEM from a user with SeImpersonatePrivilege (Local Service, Network Service, Administrator etc.). The compiled version is ...
1
vote
1answer
96 views

Prevent a remote privilege escalation when the root/admin password is known

Consider the following Linux system: root account is disabled (passwd -l root, passwd -d root), there is an account 'admin', with sudo rights, there is an account 'webservice', with limited ...
1
vote
1answer
849 views

Sudo "/usr/sbin/halt", "/usr/sbin/reboot", "/usr/sbin/poweroff" - how to leverage it to privilege escalation?

A normal user can execute these commands as root without providing any password (sudo includes the full path of the command so path hijack isn't the case here), could "halt", "reboot&...
0
votes
0answers
47 views

Are there advantages to using a hardware token instead of a password on a potentially compromised system?

TLDR: Is there a security benefit to regularly accessing the admin account with a hardware token rather than with a well-protected password? Long story: I'm both a developer and the system admin of ...
2
votes
1answer
82 views

Possible to inject in the middle of a ROOT NOPASSWD command with a wild card?

I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands ...
0
votes
2answers
238 views

How safe is it to use SMB file share on a machine running up-to-date Windows 10 LTSC through the Internet?

Running Windows 10 LTSC. Forwarded 445 port on the router to Windows SMB. Assuming that: My machine has no viruses in it (fresh Windows installation) It has been updated to the latest OS release I am ...
1
vote
0answers
42 views

Running non-root process in docker vs bare metal

Recently I faced argument that threw me a bit off balance. I've been suggested that running application bare metal is actually more secure than running it in container. Reasoning behind that is that ...
0
votes
0answers
400 views

Exploit apache2 service as member of www-data group

I am attempting to solve a CTF challenge where I am logged in as a member of the www-data group and the apache2 service is misconfigured and can be run as sudo without a password. What I am attempting ...
0
votes
1answer
292 views

Linux: Can unprivileged users tamper with processes running under their own identity?

Having the following pseudocode executed by a superuser, is it safe to assume that it is secure on Linux? if fork() == 0: # drop privileges to an unprivileged user, let's say "nobody" #...
0
votes
0answers
101 views

How can I use nohup command to get root access of the target machine?

I am playing ctf and I have gained access to the target machine but not as root. I can see nohup utility has root access on the machine and I used this command to get the root access but that did not ...
1
vote
1answer
97 views

Host filesystem manipulation from docker vs. virtual machine

When reading about docker, I found a part of the documentation describing the attack surface of the docker daemon. From what I was able to understand, part of the argument is that it is possible to ...
0
votes
0answers
77 views

Taking over Windows DC as a domain user

What do you suggest in order to take over a Windows Domain Controller, given the fact that you gained access to a domain user workstation and so you have domain user credentials? I have domain user ...
1
vote
2answers
547 views

inject update-motd.d 00-header to run a script on ssh login

Is there a way to inject the 00-header to trigger a script that executes a shell upon ssh login. I'm facing a scenario where the 00-header has root privileges and I can modify it. I'm trying to have ...
1
vote
0answers
251 views

linuxpam-pam unix-security-bypass

https://exchange.xforce.ibmcloud.com/vulnerabilities/31739 linuxpam-pamunix-security-bypass (31739) reported Jan 23, 2007 Linux-PAM could allow a remote attacker to bypass security restrictions, ...
1
vote
2answers
184 views

I am a member of the Administrators group on a Windows 7 box, how can I spawn a reverse shell with elevated privileges?

I am learning Windows Privilege escalation. I've managed to add a user to the Administrators group but I don't know how to execute nc.exe, present in the Temp dir, with elevated privileges. I am ...
107
votes
11answers
45k views

Is `sudo` almost useless?

Once an attacker has a shell as your sudoer user (or just compromised a local process enough), he/she can use one of the many privilege escalation tool to even automatically put themselves for example ...
1
vote
2answers
3k views

How do I know/find out about Minecraft Server Vulnerabilities?

I remember playing Minecraft (Java-we're only talking about Minecraft Java on the computer here) at like 13-14 years old, and having this server owner claim that the server has been hacked, and that ...
1
vote
1answer
173 views

What does the following lines of code mean? Can anyone explain step by step? [closed]

I'm still learning and this was a part of using systemctl for privilege escalation. eop=$(mktemp).service echo '[Service] ExecStart=/bin/sh -c "cat /root/root.txt > /tmp/output" [Install] ...
0
votes
2answers
1k views

Exectuting sudo command in one line within a non-tty shell

I have access to a server via RCE over http. I can send post requests to the server which results in command execution. I am attempting to escalate privileges via sudo (su is not installed). The ...
0
votes
3answers
243 views

Does sudo ever de-escalate privilege while the program/command/service is running?

For Example Is it safer to do: $ sudo [cmd] [args] [enter user password] or $ su - [enter root password] # [cmd] [args] I always assumed they are the exact same thing, because sudo utilizes ...
0
votes
0answers
556 views

Powershell (WinRM) and cmd.exe: reg query output deviation

during a CTF I encountered the following anomaly regarding PS & cmd.exe: I got access to a Windows x86 server through WinRM Port 5985 using evil-winrm. (https://github.com/Hackplayers/evil-winrm) ...
1
vote
1answer
229 views

Why not use sudo instead of setuid/setgid?

If it is an insecure practise to use setuid/setgid binaries, why do distributions, OSes force it? The big question: what prevents using sudo instead of the setuid/setgid binaries? "ping" would be ...
17
votes
1answer
13k views

How to do a privileges escalation with ping?

I am trying to achieve a privilege escalation. I have a virtual machine on Linux and I escaped from an rbash terminal. I have now a "normal" user terminal. My user is not in the sudoers file. Is it ...
-1
votes
1answer
942 views

Privilege escalation modifying cookie

I have two accounts, an administrator and a simple user. I can capture the administrator's cookie and use it in a simple user request, I find myself logged in with the administrator user and then log ...
12
votes
5answers
674 views

How can one tell if a binary is safe to give sudo permissions for to an untrusted user?

sudo is sometimes used to give untrusted or "semi-trusted" users the ability to perform certain tasks as root, while not giving them unlimited root access. This is usually done via an entry into /etc/...
1
vote
2answers
310 views

sudo whitelist just program perl

In visudo Ubuntu I whitelist this program myuser ALL=(root) NOPASSWD:/myuser/program.pl when I run sudo /myuser/program.pl I get prompt to set password. The solution is to add to visudo /usr/bin/...
8
votes
1answer
7k views

How to execute a command directly on the host system through docker.sock in a Docker container?

I've been studying Docker security and examining ways of escaping from container to host. Suppose Docker sock (docker.sock) is mounted into the container at /var/run/docker.sock, so that Docker ...
1
vote
4answers
1k views

Why doesn't NordVPN require sudo?

I've downloaded and installed NordVPN on Ubuntu and am a bit incredulous at its operation. After I downloaded its .deb file and installed it, apparently it can be activated with the command nordvpn ...
0
votes
1answer
87 views

Do world-writable systemd .service files created as symbolic links in /etc/systemd/system impose a security threat? [closed]

Do world-writable systemd .service files created as symbolic links in /etc/systemd/system impose a security threat? Would it be possible to somehow modify the links to target arbitrary .service files ...
2
votes
1answer
133 views

Is it ok to let someone unlock their own account with their admin account?

Scenario: Person A's normal computer account is personA. They have locked this out with too many bad password attempts. The user is part of the IT group, so they also have an admin account: personA-...
1
vote
1answer
82 views

Finding applications vulnerable to dll preloading on windows

An application is vulnerable to DLL preloading attack on Windows if it loads a DLL simply by it's name. Windows then goes on to search several folders and loads the first DLL with a matching name. ...
1
vote
1answer
2k views

Exploiting cron job running as root

There is a cron job running as root on a web server every 15 minutes: php cli-script.php (cli stands for "Command Line Interface", so is only accessible from command-line) It is not possible to ...
2
votes
2answers
1k views

Privilege Escalation TTY error while using sudo /usr/bin/vi command [closed]

I am currently trying to escalate my privileges on an Ubuntu box. When I enumerated the server and run "sudo -l" command, I found out /usr/bin/vi set to (root) NOPASSWD. (root) NOPASSWD: /usr/bin/vi /...
1
vote
1answer
4k views

Why doesn't my systemctl command work? [closed]

I'm working on a pentest VM, and have elevated my user privileges to that of a common user. I can see from my enumeration scans that systemctl has a SUID bit set, and has the ownership group listed as ...
2
votes
1answer
1k views

sudo restrictions circumvention with pkexec: root shell

I had corrupted my sudo setup. With no possibility to login as root (locked root account, broken sudo), a search made it clear: use pkexec. It worked. So far, so good. But that turns out to be a big ...
5
votes
1answer
167 views

How can a bad process obtain root by waiting for a user to run a command as sudo?

A comment on this answer states: The whole linux desktop provides very little protection against bad processes running as the user. A bad process could just watch the keyboard input and wait for ...
0
votes
0answers
65 views

What is possible with a non-administrative users Ticket Granting Ticket and/or NTLM hash?

During a penetration test, if a users NTLM hash or a valid Kerberos TGT is compromised, what attacks are possible if the user is not an administrator on any (in scope) workstations? For instance, it ...