Questions tagged [privilege-escalation]

Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access throughout the environment

Filter by
Sorted by
Tagged with
0
votes
1answer
68 views

Privilege escalation modifying cookie

I have two accounts, an administrator and a simple user. I can capture the administrator's cookie and use it in a simple user request, I find myself logged in with the administrator user and then log ...
12
votes
5answers
433 views

How can one tell if a binary is safe to give sudo permissions for to an untrusted user?

sudo is sometimes used to give untrusted or "semi-trusted" users the ability to perform certain tasks as root, while not giving them unlimited root access. This is usually done via an entry into /etc/...
0
votes
0answers
21 views

Unquoted Service Path with Windows Short Filename ( 8.3 filename convention)

So if there is a service which has executable path as below. Path to executable : C:\PROGRA~1\ABCSOFT~\service.exe Here the path is shortened using "8.3 filename" convention and the actual complete ...
1
vote
0answers
90 views

Sudo parameterised all commands, is this secure? [closed]

About this question sudo white list just program perl I think I found possible solution using just sudo have a program Perl and make executable chmod + x in sudo whitelist that program and ...
1
vote
1answer
135 views

sudo whitelist just program perl

In visudo Ubuntu I whitelist this program myuser ALL=(root) NOPASSWD:/myuser/program.pl when I run sudo /myuser/program.pl I get prompt to set password. The solution is to add to visudo /usr/bin/...
0
votes
0answers
132 views

DLL Hijacking doesn't work (DLL Proxy technique)

I found DLL Hijacking vulnerability in a program. It doesn't load VERSION.dll properly. Then I try to use DLL Proxying technique. I try to create malicious DLL with C++. This is my code: #pragma ...
3
votes
1answer
98 views

How to execute a command directly on the host system through docker.sock in a Docker container? [closed]

I've been studying Docker security and examining ways of escaping from container to host. Suppose Docker sock (docker.sock) is mounted into the container at /var/run/docker.sock, so that Docker ...
0
votes
2answers
112 views

Why doesn't nordvpn require sudo?

I've downloaded and installed nordvpn on Ubuntu and am a bit incredulous at its operation. After I downloaded its .deb file and installed it, apparently it can be activated with the command nordvpn ...
0
votes
1answer
57 views

Do world-writable systemd .service files created as symbolic links in /etc/systemd/system impose a security threat? [closed]

Do world-writable systemd .service files created as symbolic links in /etc/systemd/system impose a security threat? Would it be possible to somehow modify the links to target arbitrary .service files ...
2
votes
1answer
82 views

Is it ok to let someone unlock their own account with their admin account?

Scenario: Person A's normal computer account is personA. They have locked this out with too many bad password attempts. The user is part of the IT group, so they also have an admin account: personA-...
1
vote
1answer
40 views

Finding applications vulnerable to dll preloading on windows

An application is vulnerable to DLL preloading attack on Windows if it loads a DLL simply by it's name. Windows then goes on to search several folders and loads the first DLL with a matching name. ...
1
vote
1answer
466 views

Exploiting cron job running as root

There is a cron job running as root on a web server every 15 minutes: php cli-script.php (cli stands for "Command Line Interface", so is only accessible from command-line) It is not possible to ...
2
votes
2answers
241 views

Privilege Escalation TTY error while using sudo /usr/bin/vi command [closed]

I am currently trying to escalate my privileges on an Ubuntu box. When I enumerated the server and run "sudo -l" command, I found out /usr/bin/vi set to (root) NOPASSWD. (root) NOPASSWD: /usr/bin/vi /...
1
vote
1answer
1k views

Why doesn't my systemctl command work? [closed]

I'm working on a pentest VM, and have elevated my user privileges to that of a common user. I can see from my enumeration scans that systemctl has a SUID bit set, and has the ownership group listed as ...
2
votes
1answer
306 views

sudo restrictions circumvention with pkexec: root shell

I had corrupted my sudo setup. With no possibility to login as root (locked root account, broken sudo), a search made it clear: use pkexec. It worked. So far, so good. But that turns out to be a big ...
5
votes
1answer
109 views

How can a bad process obtain root by waiting for a user to run a command as sudo?

A comment on this answer states: The whole linux desktop provides very little protection against bad processes running as the user. A bad process could just watch the keyboard input and wait for ...
0
votes
0answers
48 views

What is possible with a non-administrative users Ticket Granting Ticket and/or NTLM hash?

During a penetration test, if a users NTLM hash or a valid Kerberos TGT is compromised, what attacks are possible if the user is not an administrator on any (in scope) workstations? For instance, it ...
0
votes
1answer
270 views

Django admin site privilege escalation

Last night, I read a PDF detailing a privilege escalation attack a researcher had performed on a Django admin site. I'm curious- was the unfortunate application susceptible to this attack due to a ...
0
votes
0answers
213 views

Privilege Escalation using a leaked thread handle without SeAssignPrimaryTokenPrivilege or SeImpersonatePrivilege

I have a leaked thread handle that grants me THREAD_ALL_ACCESS over a thread of a process running as SYSTEM. My process is running unprivileged and has no special privileges. This means I do not have ...
0
votes
0answers
119 views

Named pipe impersonation affected windows versions

I want to know which windows versions are vulnerable to named pipe impersonation attack. And, are the techniques used in that attack for each version the same?
0
votes
0answers
69 views

set-guid exploit of a program with relative path

I'm trying to exploit a program which has the set-guid bit enabled. The program is simple it contains the following (stage.c): #include <stdio.h> #include <stdlib.h> #include <unistd....
6
votes
2answers
307 views

Bash function manipulation explained

I was recently reading through a write up on a capture the flag Linux VulnHub machine. For privilege escalation, the author references 'bash function manipulation'. A Google search turns up very ...
1
vote
1answer
2k views

How can privilege escalation through pkexec be prevented?

I've managed to elevate privileges on a Linux machine (3.19) using pkexec, but I don't understand the mechanics. /usr/bin/pkexec has the SUID bit set (which is normal, I gather), and simply using it ...
0
votes
1answer
237 views

Why in LD_PRELOAD exploit we call unsetenv(LD_PRELOAD)?

Why to exploit LD_PRELOAD like is shown here https://touhidshaikh.com/blog/?p=827 in the .c file the first instruction is unsetenv(LD_PRELOAD)? Is it a routine action which all shared libraries do? Or ...
1
vote
1answer
118 views

Using SUID program to avoid having entries in sudoers

Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
1
vote
2answers
268 views

What is the difference between “missing function level access control” and “privilege escalation”?

I was going through a web application from my account and I was able to view some confidential information about my other account. I want to know if this is a case of missing function level access ...
0
votes
0answers
239 views

Unable to write to C:\ folder when logged in through BUILTIN\Users account | Windows Privilege Escalation | Unquoted Service Path

I have made an auto-start service from user (who is only in Administrators group and not Users) command prompt which is vulnerable to Unquoted Service Path. Executable path: C:\Program Files\A ...
1
vote
1answer
634 views

Get the privileges of root with the user with I do an exploit with Shellshock [closed]

I got the remote control of a linux machine with Shellshock attack in Kali Linux (attacker machine) to a TinyCore Linux (victim machine), I used this module to attack the CGI vulnerability: use ...
0
votes
0answers
152 views

Exploit TinyCore Linux 4.2.9 with DirtyCow remote from Kali Linux

Do you know if is possible execute an exploit from Kali Linux for obtain root privileges in a remote machine (that I have exploited before with a local user) with tiny-core Linux version 4.2.9, I've ...
1
vote
2answers
105 views

Privilege Escalation On Shared Server [closed]

I recently did a ca /etc/passwd And it revealed many accounts and their respective directories. Is my shared server secure? Does this tell anything? Can a good hacker access my directory from ...
1
vote
1answer
402 views

Privilege escalation in Linux 2.6.32

I am in an audit and I need to show the client that privileges can be scaled but I have tried in various ways and I could not. The Kernel version is 2.6.32-754.3.5.el6.x86_64. I have already tried ...
1
vote
0answers
380 views

Command line tools exploitable on linux

I'm looking this interesting project https://gtfobins.github.io/ But I don't understand some assumption. For example, if you consider the mv command: https://gtfobins.github.io/gtfobins/mv/ They ...
2
votes
1answer
291 views

Is there a list of safe/normal/expected SUID files?

Exploitable SUID executables are a basic privilege escalation vector. But just doing a search for all such files turns up a bunch of results on any linux system, most or all of which are presumed to ...
64
votes
4answers
13k views

Are most Linux systems that allow non-root users to execute code straightforwardly rootable?

long story short if you can execute code on a box it is usually straightforward to get root (quote source) The immediate implication of this quote (if it's accurate) is that if you're running a ...
0
votes
2answers
969 views

Privilege Escalation: C functions setuid(0) with system() not working in Linux

Quick disclaimer: I fully understand that the code I am attempting to write is insecure, and allows for arbitrary users to escalate to root. I am writing a simple C program like this to demonstrate ...
1
vote
1answer
117 views

Harden against privilege escalation in Microservices

Please consider the following scenario. The system has a set of business owners (i.e. users of the system) Each business owner is mapped to a set of customers The business owners login to the system ...
5
votes
5answers
238 views

Unix Privilege Escalation: “sudo must be owned by uid 0 and have the setuid bit set”

It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error: "sudo must be owned ...
3
votes
1answer
899 views

Running Docker container as Root user

Running a Docker container process as root inside the container is considered insecure. But I have some doubts that I need to clear: Is it still the same kind of insecure even if the container cannot ...
35
votes
2answers
4k views

Why is SUID disabled for shell scripts but not for binaries?

While I understand the idea of SUID is to let an unprivileged user run a program as a privileged user, I have found that SUID usually doesn't work on a shell script without some workarounds. My ...
1
vote
3answers
223 views

Is there a way to overwrite a file being used by a service without service management permissions?

I am trying to demo an exploit and here is the scenario: A service is running with SYSTEM privileges where the executable it is running (binpath) can be modified by any user. The exploit consists of ...
3
votes
2answers
436 views

Privileges needed to perform process injections

I am reading about process injection techniques on Windows machines (originally came to this from privilege escalation research). Although I used Windows for the majority of my life, I feel like I ...
3
votes
0answers
430 views

Exploiting Environment Variables in Scheduled Tasks for UAC Bypass

I am trying to escalate privileges from an ISS user on Windows Server 2012 R2 by exploiting Environment Variables in Scheduled Tasks for UAC Bypass as the following link explains the exploit: https://...
0
votes
3answers
306 views

Is it risky to mount tmpfs volumes in Docker?

Sometimes I need to run I/O intensive operations in memory. The tmpfs facility works really well for this, but I was wondering if there are any big risks of using tmpfs mounts inside a container. Can ...
0
votes
1answer
178 views

Is it normal to being able to kill a process from outside a container?

Situation: on user@host a qemu run and stack inside a container user@container Is it normal: to view with ps aux | grep qemu from user@host that the process run on user@container? to be able to ...
3
votes
2answers
423 views

Which Linux commands can execute user-supplied code? [closed]

As explained here (https://www.helpnetsecurity.com/2014/06/27/exploiting-wildcards-on-linux/), the tar command can be used to execute arbitrary code. Is there a list of Linux commands, preferably ...
1
vote
0answers
132 views

Windows Possible Vectors for Privilege Escalation From “Weak” Folder ACLs

I am doing a security analysis and I am trying to figure out what the possible attack vectors and possibility of privilege escalation's are of the way this program is setup? I used Attack Surface ...
0
votes
0answers
558 views

Windows limited shell escape

I still cannot understand one concept of Windows system exploitation. There are many ways to get a shell on Windows machine - BO exploit, Web reverse shell, .exe launch. After that you gain a non-...
6
votes
2answers
690 views

Do sudo and .profile/.bashrc enable trivial privilege escalation?

First of all, let me mention that I’m assuming a configuration as set up by current Linux desktop distributions (e. g. Debian, Fedora). I’m sure that there are methods which, if implemented, would ...
1
vote
2answers
945 views

Shellcode does not execute as the owner

(This is a question regarding a challenge in a wargame on overthewire.org called Narnia) Here is the source code of the vulnerable script "narnia1" I intend to exploit: #include <stdio.h> int ...
1
vote
0answers
121 views

SUID not executing as root [duplicate]

I am trying to learn about SUIDs and have run into bit of a stumbling block - I have a ubuntu 16.04 system. I have set a few default binaries such as vim, find et al. to have SUID permissions as ...