Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [privilege-escalation]

Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access throughout the environment

1
vote
1answer
63 views

Get the privileges of root with the user with I do an exploit with Shellshock [on hold]

I got the remote control of a linux machine with Shellshock attack in Kali Linux (attacker machine) to a TinyCore Linux (victim machine), I used this module to attack the CGI vulnerability: use ...
0
votes
0answers
45 views

Exploit TinyCore Linux 4.2.9 with DirtyCow remote from Kali Linux

Do you know if is possible execute an exploit from Kali Linux for obtain root privileges in a remote machine (that I have exploited before with a local user) with tiny-core Linux version 4.2.9, I've ...
1
vote
2answers
68 views

Privilege Escalation On Shared Server [closed]

I recently did a ca /etc/passwd And it revealed many accounts and their respective directories. Is my shared server secure? Does this tell anything? Can a good hacker access my directory from ...
1
vote
1answer
162 views

Privilege escalation in Linux 2.6.32

I am in an audit and I need to show the client that privileges can be scaled but I have tried in various ways and I could not. The Kernel version is 2.6.32-754.3.5.el6.x86_64. I have already tried ...
-1
votes
0answers
48 views

Manually linking C library for priv esc

I am currently working on a challenge on Hack the Box and am trying to get an existing executable on an exercise machine to run by library in place of one that is missing from the 'vulnerable' script. ...
1
vote
0answers
67 views

Command line tools exploitable on linux

I'm looking this interesting project https://gtfobins.github.io/ But I don't understand some assumption. For example, if you consider the mv command: https://gtfobins.github.io/gtfobins/mv/ They ...
0
votes
1answer
44 views

Is there a list of safe/normal/expected SUID files?

Exploitable SUID executables are a basic privilege escalation vector. But just doing a search for all such files turns up a bunch of results on any linux system, most or all of which are presumed to ...
63
votes
4answers
12k views

Are most Linux systems that allow non-root users to execute code straightforwardly rootable?

long story short if you can execute code on a box it is usually straightforward to get root (quote source) The immediate implication of this quote (if it's accurate) is that if you're running a ...
0
votes
2answers
101 views

Privilege Escalation: C functions setuid(0) with system() not working in Linux

Quick disclaimer: I fully understand that the code I am attempting to write is insecure, and allows for arbitrary users to escalate to root. I am writing a simple C program like this to demonstrate ...
0
votes
1answer
63 views

Harden against privilege escalation in Microservices

Please consider the following scenario. The system has a set of business owners (i.e. users of the system) Each business owner is mapped to a set of customers The business owners login to the system ...
5
votes
5answers
173 views

Unix Privilege Escalation: “sudo must be owned by uid 0 and have the setuid bit set”

It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error: "sudo must be owned ...
2
votes
1answer
226 views

Running Docker container as Root user

Running a Docker container process as root inside the container is considered insecure. But I have some doubts that I need to clear: Is it still the same kind of insecure even if the container cannot ...
34
votes
2answers
3k views

Why is SUID disabled for shell scripts but not for binaries?

While I understand the idea of SUID is to let an unprivileged user run a program as a privileged user, I have found that SUID usually doesn't work on a shell script without some workarounds. My ...
1
vote
3answers
75 views

Is there a way to overwrite a file being used by a service without service management permissions?

I am trying to demo an exploit and here is the scenario: A service is running with SYSTEM privileges where the executable it is running (binpath) can be modified by any user. The exploit consists of ...
2
votes
2answers
93 views

Privileges needed to perform process injections

I am reading about process injection techniques on Windows machines (originally came to this from privilege escalation research). Although I used Windows for the majority of my life, I feel like I ...
3
votes
0answers
192 views

Exploiting Environment Variables in Scheduled Tasks for UAC Bypass

I am trying to escalate privileges from an ISS user on Windows Server 2012 R2 by exploiting Environment Variables in Scheduled Tasks for UAC Bypass as the following link explains the exploit: https://...
0
votes
3answers
130 views

Is it risky to mount tmpfs volumes in Docker?

Sometimes I need to run I/O intensive operations in memory. The tmpfs facility works really well for this, but I was wondering if there are any big risks of using tmpfs mounts inside a container. Can ...
0
votes
1answer
80 views

Is it normal to being able to kill a process from outside a container?

Situation: on user@host a qemu run and stack inside a container user@container Is it normal: to view with ps aux | grep qemu from user@host that the process run on user@container? to be able to ...
0
votes
0answers
219 views

Does LocalAccountTokenFilterPolicy registry value completely mitigate Windows pass-the-hash (PtH)?

I've been sitting for hours trying to get PsExec and windows/smb/psexec to work without luck, always getting the "Access is denied." error, until I came across the following article on Windows Vista: ...
3
votes
2answers
392 views

Which Linux commands can execute user-supplied code? [closed]

As explained here (https://www.helpnetsecurity.com/2014/06/27/exploiting-wildcards-on-linux/), the tar command can be used to execute arbitrary code. Is there a list of Linux commands, preferably ...
1
vote
0answers
52 views

Windows Possible Vectors for Privilege Escalation From “Weak” Folder ACLs

I am doing a security analysis and I am trying to figure out what the possible attack vectors and possibility of privilege escalation's are of the way this program is setup? I used Attack Surface ...
0
votes
0answers
286 views

Windows limited shell escape

I still cannot understand one concept of Windows system exploitation. There are many ways to get a shell on Windows machine - BO exploit, Web reverse shell, .exe launch. After that you gain a non-...
6
votes
2answers
363 views

Do sudo and .profile/.bashrc enable trivial privilege escalation?

First of all, let me mention that I’m assuming a configuration as set up by current Linux desktop distributions (e. g. Debian, Fedora). I’m sure that there are methods which, if implemented, would ...
1
vote
2answers
370 views

Shellcode does not execute as the owner

(This is a question regarding a challenge in a wargame on overthewire.org called Narnia) Here is the source code of the vulnerable script "narnia1" I intend to exploit: #include <stdio.h> int ...
1
vote
0answers
59 views

SUID not executing as root [duplicate]

I am trying to learn about SUIDs and have run into bit of a stumbling block - I have a ubuntu 16.04 system. I have set a few default binaries such as vim, find et al. to have SUID permissions as ...
2
votes
1answer
495 views

Why is the setuid bit not working when I execute this binary?

I am currently going through the Narnia challenges on overthewire.org. For the 1-->2 challenge, I am running into an issue that I can't seem to get around. Basically there is a C program called ...
2
votes
2answers
565 views

Privilege Escalation Wordpress

I have access to a Wordpress blog and want to read the server's /root directory that belongs to the user "root" and not "www-data". I also know his password, but I can't open an interactive shell to ...
-1
votes
1answer
148 views

How can I protect my cloud processing from everyone … even those with root access?

How can I run my top secret code and data on any cloud hosting provider such that everyone even the hosting vendor with root is denied access ? ... a research proposal What is the current state of ...
0
votes
0answers
151 views

Why does Ubuntu deem 16.04 un-affected by CVE-2017-16995(Kernel Privilege Escalation) while it's not?

In both current OVAL definition and CVE Tracker, it says for Ubuntu 16.04 While related to the CVE in some way, the 'linux' package in xenial is not affected. But I have tested many kernel ...
8
votes
3answers
340 views

How do I create an invisible and persistent user on linux?

For my software security class we are required to hack into a server created by our professor. I have hacked into the server, and have the password for the root user. Now that I am root, I would ...
2
votes
0answers
36 views

What potential security issues running sandboxd as root?

I have noticed that MacOS is running its sandbox process under the root user. This implies that any sandboxed process, assuming that it can escape the sandbox, would then have root privileges. Am I ...
0
votes
0answers
243 views

How to reproduce Skype DLL hijacking vulnerability?

Recently, a vulnerability was discovered in Skype - specifically, the Skype Updater - which allowed full privilege escalation to SYSTEM. The description of this vulnerability seems fairly ...
6
votes
2answers
1k views

What does this sudo -l output mean and can this be priv. escalated?

I am trying to do priviledge escalation of a linux box. My sudo -l output shows the following : www-data@box:/scripts$ sudo -l sudo -l Matching Defaults entries for www-data on box: env_reset, ...
0
votes
1answer
376 views

What is the difference between privilege escalation and authorization bypass?

As I understand when a user with low privilege does some actions only available for users with high privilege this is called privilege escalation. And authorization bypass is when I do some actions ...
8
votes
1answer
1k views

Is it secure to mount Veracrypt without sudo password in this way

Does this way have any security issues other than what's mentioned in that post? For reference: Create a new group called say veracryptusers and give it the necessary permissions to use VeraCrypt ...
2
votes
1answer
378 views

How detrimental is a NULL pointer dereference vulnerability today?

Recently I have been reading about the implications of NULL pointer dereferences in kernel code (often LKMs/modules), specifically escalating privileges to root via mmap()ing the NULL page and then ...
3
votes
1answer
2k views

How to use a sh SUID script to get privilege escalation?

As www-data user (non-privileged user) I have found this SUID, world-writable shell script: www-data@Cisco:/home/cripto$ ls -al /etc/init.d/admin -rwsr-xrwx 1 root bob 233 Nov 12 13:09 /etc/init.d/...
1
vote
1answer
72 views

Unable to replace linux binary

I'm working on a linux privilege escalation. This is the situation: I'm able to write to /bin, and I only have sudo access to run a script. This script just prints information with an echo. I copied ...
2
votes
2answers
578 views

Debugging SUID for privilege escalation

When doing privilege escalation, assuming an application with the SUID set and a debugger, what stops us from starting a shell from within the debugger? I mean just write the shell code in an ...
1
vote
0answers
23 views

IBM OS/400 - What is the risk of the object authority *ALL on user object?

During a review of an IBM OS/400, I noticed that some objects representing users had the object authority *ALL for the user *PUBLIC. What is the risk of having an object representing a user with the ...
5
votes
0answers
314 views

Can any of the INTEL-SA-00086 vulnerabilities be exploited by an unprivileged user?

Several of the latest Intel Management Engine vulnerabilities are listed as local vulnerabilities, allowing code executing on the system to elevate its privileges to ME context. One of them (CVE-2017-...
1
vote
1answer
146 views

What is a safe way to exit a user's shell?

If I change to a potentially compromised user in Unix, for example by using su or sudo -i, then exit with exit, the compromised user could alias exit to something which drops me into a fake shell ...
2
votes
2answers
666 views

Windows Privilege Escalation system shell dies quickly

I have a user restricted shell and I used a host upnpn exploit which gives me root access to nc.exe. I am able to get a shell as SYSTEM but it dies after 30 seconds due to the service being ...
1
vote
0answers
748 views

Trick needed to make use of a local buffer overflow vulnerability to obtain root

I am working on a certain CTF trying to gain root privileges in it, I found a vulnerable program to buffer overflow vulnerability with Non executable stack security level (NX), I developed an exploit ...
4
votes
1answer
222 views

What are escalation pathways from a VM to its host?

If I want to check out a dodgy link from a friend, I've started opening these in a virtual machine. I'm assuming that if the VM gets hacked, the host where I do internet banking etc will still be fine....
185
votes
6answers
29k views

Isn't Ubuntu's system prompt for my password spoofable?

Sometimes, Ubuntu shows the following window: This window can be caused by some background processes running, such as an automatic update, or a process which reports bugs to Canonical which manifests ...
0
votes
1answer
143 views

Finding Windows API Vulnerabilities

Currently I'm reading about the Windows API's like CreateProcess and others. Also I took a look into the Source of the Powershell Script which used the MS16-032 vulnerability. My Question is: Which ...
9
votes
1answer
1k views

Gained Privilege Escalation but no authority using Metasploit

I am facing a very weird issue. I have successfully popped a box using Shellter with Meterpreter_Reverse TCP. Here is the sysinfo : meterpreter > sysinfo Computer : ******** OS ...
1
vote
1answer
372 views

Shell not always escalating privileges in narnia

I'm going through the various overthewire wargames and I have a question about narnia0. The code in c contains if(val==0xdeadbeef) system("/bin/sh"); else { printf("WAY OFF!!!!\n"); I got it to work ...
1
vote
1answer
312 views

DLL hijacking - How to find out if path is relative

I am playing around with dll-hijacking and was wondering about something that I haven't been able to find out myself by googling. I get how the basics work with the fact that DLL's are loaded by an ...