Questions tagged [privilege-escalation]

Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access throughout the environment

Filter by
Sorted by
Tagged with
2
votes
1answer
37 views

Possible to inject in the middle of a ROOT NOPASSWD command with a wild card?

I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands ...
0
votes
2answers
62 views

How safe is it to use SMB file share on a machine running up-to-date Windows 10 LTSC through the Internet?

Running Windows 10 LTSC. Forwarded 445 port on the router to Windows SMB. Assuming that: My machine has no viruses in it (fresh Windows installation) It has been updated to the latest OS release I am ...
0
votes
0answers
27 views

Running non-root process in docker vs bare metal

Recently I faced argument that threw me a bit off balance. I've been suggested that running application bare metal is actually more secure than running it in container. Reasoning behind that is that ...
0
votes
0answers
59 views

Exploit apache2 service as member of www-data group

I am attempting to solve a CTF challenge where I am logged in as a member of the www-data group and the apache2 service is misconfigured and can be run as sudo without a password. What I am attempting ...
0
votes
0answers
56 views

security implications of libvirt socket access

In most Linux distributions it is possible to manage virtual machines as a regular user if that user has access to /run/libvirt/libvirt-sock and is a member of the libvirt group. I understand that we ...
0
votes
1answer
124 views

Linux: Can unprivileged users tamper with processes running under their own identity?

Having the following pseudocode executed by a superuser, is it safe to assume that it is secure on Linux? if fork() == 0: # drop privileges to an unprivileged user, let's say "nobody" #...
0
votes
0answers
61 views

How can I use nohup command to get root access of the target machine?

I am playing ctf and I have gained access to the target machine but not as root. I can see nohup utility has root access on the machine and I used this command to get the root access but that did not ...
1
vote
1answer
72 views

Host filesystem manipulation from docker vs. virtual machine

When reading about docker, I found a part of the documentation describing the attack surface of the docker daemon. From what I was able to understand, part of the argument is that it is possible to ...
0
votes
0answers
65 views

Taking over Windows DC as a domain user

What do you suggest in order to take over a Windows Domain Controller, given the fact that you gained access to a domain user workstation and so you have domain user credentials? I have domain user ...
1
vote
1answer
211 views

inject update-motd.d 00-header to run a script on ssh login

Is there a way to inject the 00-header to trigger a script that executes a shell upon ssh login. I'm facing a scenario where the 00-header has root privileges and I can modify it. I'm trying to have ...
1
vote
0answers
123 views

linuxpam-pam unix-security-bypass

https://exchange.xforce.ibmcloud.com/vulnerabilities/31739 linuxpam-pamunix-security-bypass (31739) reported Jan 23, 2007 Linux-PAM could allow a remote attacker to bypass security restrictions, ...
1
vote
2answers
108 views

I am a member of the Administrators group on a Windows 7 box, how can I spawn a reverse shell with elevated privileges?

I am learning Windows Privilege escalation. I've managed to add a user to the Administrators group but I don't know how to execute nc.exe, present in the Temp dir, with elevated privileges. I am ...
102
votes
11answers
44k views

Is `sudo` almost useless?

Once an attacker has a shell as your sudoer user (or just compromised a local process enough), he/she can use one of the many privilege escalation tool to even automatically put themselves for example ...
0
votes
0answers
157 views

Metasploit: Issue with upgrading a low privilege shell (sessions -u)

Setup info: I don't believe this is the issue as I regularly update my system. I'll add one piece of information as an example. If you would really like to the rest then I can add more in later ...
1
vote
2answers
1k views

How do I know/find out about Minecraft Server Vulnerabilities?

I remember playing Minecraft (Java-we're only talking about Minecraft Java on the computer here) at like 13-14 years old, and having this server owner claim that the server has been hacked, and that ...
0
votes
1answer
102 views

What does the following lines of code mean? Can anyone explain step by step? [closed]

I'm still learning and this was a part of using systemctl for privilege escalation. eop=$(mktemp).service echo '[Service] ExecStart=/bin/sh -c "cat /root/root.txt > /tmp/output" [Install] ...
0
votes
2answers
506 views

Exectuting sudo command in one line within a non-tty shell

I have access to a server via RCE over http. I can send post requests to the server which results in command execution. I am attempting to escalate privileges via sudo (su is not installed). The ...
0
votes
2answers
142 views

Does sudo ever de-escalate privilege while the program/command/service is running?

For Example Is it safer to do: $ sudo [cmd] [args] [enter user password] or $ su - [enter root password] # [cmd] [args] I always assumed they are the exact same thing, because sudo utilizes ...
0
votes
0answers
46 views

Bypassing non-writeable permissions on Ubuntu server

Say I have gained RCE on a server which has a firewall blocking all egress traffic: Linux cmweb6 4.15.0-1040-azure #44-Ubuntu SMP Thu Feb 21 14:24:01 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux But I am ...
0
votes
0answers
476 views

Powershell (WinRM) and cmd.exe: reg query output deviation

during a CTF I encountered the following anomaly regarding PS & cmd.exe: I got access to a Windows x86 server through WinRM Port 5985 using evil-winrm. (https://github.com/Hackplayers/evil-winrm) ...
1
vote
1answer
166 views

Why not use sudo instead of setuid/setgid?

If it is an insecure practise to use setuid/setgid binaries, why do distributions, OSes force it? The big question: what prevents using sudo instead of the setuid/setgid binaries? "ping" would be ...
17
votes
1answer
10k views

How to do a privileges escalation with ping?

I am trying to achieve a privilege escalation. I have a virtual machine on Linux and I escaped from an rbash terminal. I have now a "normal" user terminal. My user is not in the sudoers file. Is it ...
-1
votes
1answer
557 views

Privilege escalation modifying cookie

I have two accounts, an administrator and a simple user. I can capture the administrator's cookie and use it in a simple user request, I find myself logged in with the administrator user and then log ...
12
votes
5answers
582 views

How can one tell if a binary is safe to give sudo permissions for to an untrusted user?

sudo is sometimes used to give untrusted or "semi-trusted" users the ability to perform certain tasks as root, while not giving them unlimited root access. This is usually done via an entry into /etc/...
1
vote
2answers
252 views

sudo whitelist just program perl

In visudo Ubuntu I whitelist this program myuser ALL=(root) NOPASSWD:/myuser/program.pl when I run sudo /myuser/program.pl I get prompt to set password. The solution is to add to visudo /usr/bin/...
8
votes
1answer
2k views

How to execute a command directly on the host system through docker.sock in a Docker container?

I've been studying Docker security and examining ways of escaping from container to host. Suppose Docker sock (docker.sock) is mounted into the container at /var/run/docker.sock, so that Docker ...
1
vote
4answers
640 views

Why doesn't NordVPN require sudo?

I've downloaded and installed NordVPN on Ubuntu and am a bit incredulous at its operation. After I downloaded its .deb file and installed it, apparently it can be activated with the command nordvpn ...
0
votes
1answer
64 views

Do world-writable systemd .service files created as symbolic links in /etc/systemd/system impose a security threat? [closed]

Do world-writable systemd .service files created as symbolic links in /etc/systemd/system impose a security threat? Would it be possible to somehow modify the links to target arbitrary .service files ...
2
votes
1answer
108 views

Is it ok to let someone unlock their own account with their admin account?

Scenario: Person A's normal computer account is personA. They have locked this out with too many bad password attempts. The user is part of the IT group, so they also have an admin account: personA-...
1
vote
1answer
66 views

Finding applications vulnerable to dll preloading on windows

An application is vulnerable to DLL preloading attack on Windows if it loads a DLL simply by it's name. Windows then goes on to search several folders and loads the first DLL with a matching name. ...
1
vote
1answer
2k views

Exploiting cron job running as root

There is a cron job running as root on a web server every 15 minutes: php cli-script.php (cli stands for "Command Line Interface", so is only accessible from command-line) It is not possible to ...
2
votes
2answers
685 views

Privilege Escalation TTY error while using sudo /usr/bin/vi command [closed]

I am currently trying to escalate my privileges on an Ubuntu box. When I enumerated the server and run "sudo -l" command, I found out /usr/bin/vi set to (root) NOPASSWD. (root) NOPASSWD: /usr/bin/vi /...
1
vote
1answer
3k views

Why doesn't my systemctl command work? [closed]

I'm working on a pentest VM, and have elevated my user privileges to that of a common user. I can see from my enumeration scans that systemctl has a SUID bit set, and has the ownership group listed as ...
2
votes
1answer
776 views

sudo restrictions circumvention with pkexec: root shell

I had corrupted my sudo setup. With no possibility to login as root (locked root account, broken sudo), a search made it clear: use pkexec. It worked. So far, so good. But that turns out to be a big ...
5
votes
1answer
134 views

How can a bad process obtain root by waiting for a user to run a command as sudo?

A comment on this answer states: The whole linux desktop provides very little protection against bad processes running as the user. A bad process could just watch the keyboard input and wait for ...
0
votes
0answers
51 views

What is possible with a non-administrative users Ticket Granting Ticket and/or NTLM hash?

During a penetration test, if a users NTLM hash or a valid Kerberos TGT is compromised, what attacks are possible if the user is not an administrator on any (in scope) workstations? For instance, it ...
0
votes
1answer
767 views

Django admin site privilege escalation

Last night, I read a PDF detailing a privilege escalation attack a researcher had performed on a Django admin site. I'm curious- was the unfortunate application susceptible to this attack due to a ...
0
votes
0answers
197 views

set-guid exploit of a program with relative path

I'm trying to exploit a program which has the set-guid bit enabled. The program is simple it contains the following (stage.c): #include <stdio.h> #include <stdlib.h> #include <unistd....
6
votes
2answers
458 views

Bash function manipulation explained

I was recently reading through a write up on a capture the flag Linux VulnHub machine. For privilege escalation, the author references 'bash function manipulation'. A Google search turns up very ...
1
vote
1answer
8k views

How can privilege escalation through pkexec be prevented?

I've managed to elevate privileges on a Linux machine (3.19) using pkexec, but I don't understand the mechanics. /usr/bin/pkexec has the SUID bit set (which is normal, I gather), and simply using it ...
0
votes
1answer
670 views

Why in LD_PRELOAD exploit we call unsetenv(LD_PRELOAD)?

Why to exploit LD_PRELOAD like is shown here https://touhidshaikh.com/blog/?p=827 in the .c file the first instruction is unsetenv(LD_PRELOAD)? Is it a routine action which all shared libraries do? Or ...
1
vote
1answer
182 views

Using SUID program to avoid having entries in sudoers

Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
2
votes
2answers
325 views

What is the difference between “missing function level access control” and “privilege escalation”?

I was going through a web application from my account and I was able to view some confidential information about my other account. I want to know if this is a case of missing function level access ...
1
vote
1answer
1k views

Get the privileges of root with the user with I do an exploit with Shellshock [closed]

I got the remote control of a linux machine with Shellshock attack in Kali Linux (attacker machine) to a TinyCore Linux (victim machine), I used this module to attack the CGI vulnerability: use ...
1
vote
2answers
155 views

Privilege Escalation On Shared Server [closed]

I recently did a ca /etc/passwd And it revealed many accounts and their respective directories. Is my shared server secure? Does this tell anything? Can a good hacker access my directory from ...
1
vote
1answer
615 views

Privilege escalation in Linux 2.6.32

I am in an audit and I need to show the client that privileges can be scaled but I have tried in various ways and I could not. The Kernel version is 2.6.32-754.3.5.el6.x86_64. I have already tried ...
2
votes
4answers
656 views

Command line tools exploitable on linux

I'm looking this interesting project https://gtfobins.github.io/ But I don't understand some assumption. For example, if you consider the mv command: https://gtfobins.github.io/gtfobins/mv/ They ...
2
votes
1answer
783 views

Is there a list of safe/normal/expected SUID files?

Exploitable SUID executables are a basic privilege escalation vector. But just doing a search for all such files turns up a bunch of results on any linux system, most or all of which are presumed to ...
64
votes
4answers
13k views

Are most Linux systems that allow non-root users to execute code straightforwardly rootable?

long story short if you can execute code on a box it is usually straightforward to get root (quote source) The immediate implication of this quote (if it's accurate) is that if you're running a ...
0
votes
2answers
2k views

Privilege Escalation: C functions setuid(0) with system() not working in Linux

Quick disclaimer: I fully understand that the code I am attempting to write is insecure, and allows for arbitrary users to escalate to root. I am writing a simple C program like this to demonstrate ...