Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [privilege-escalation]

Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access throughout the environment

0
votes
1answer
33 views

Why in LD_PRELOAD exploit we call unsetenv(LD_PRELOAD)?

Why to exploit LD_PRELOAD like is shown here https://touhidshaikh.com/blog/?p=827 in the .c file the first instruction is unsetenv(LD_PRELOAD)? Is it a routine action which all shared libraries do? Or ...
0
votes
0answers
33 views

Gain access to files with higher privileges [on hold]

I have this vulnerable linux distribution. There are some files that only users within a specific group can access, which is not my group. And I want to access these files. I tried to use symlinks, ...
1
vote
1answer
57 views

Using SUID program to avoid having entries in sudoers

Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
1
vote
2answers
88 views

What is the difference between “missing function level access control” and “privilege escalation”?

I was going through a web application from my account and I was able to view some confidential information about my other account. I want to know if this is a case of missing function level access ...
-1
votes
1answer
64 views

Perform privilege escalation using local root exploit [on hold]

I am trying to perform a privilege escalation on a Debian 8 system running on kernel version 3.16.0-4-amd64. Since the system I am performing an audit on is not up to date I was thinking a local root ...
0
votes
0answers
88 views

Unable to write to C:\ folder when logged in through BUILTIN\Users account | Windows Privilege Escalation | Unquoted Service Path

I have made an auto-start service from user (who is only in Administrators group and not Users) command prompt which is vulnerable to Unquoted Service Path. Executable path: C:\Program Files\A ...
1
vote
1answer
156 views

Get the privileges of root with the user with I do an exploit with Shellshock [closed]

I got the remote control of a linux machine with Shellshock attack in Kali Linux (attacker machine) to a TinyCore Linux (victim machine), I used this module to attack the CGI vulnerability: use ...
0
votes
0answers
90 views

Exploit TinyCore Linux 4.2.9 with DirtyCow remote from Kali Linux

Do you know if is possible execute an exploit from Kali Linux for obtain root privileges in a remote machine (that I have exploited before with a local user) with tiny-core Linux version 4.2.9, I've ...
1
vote
2answers
84 views

Privilege Escalation On Shared Server [closed]

I recently did a ca /etc/passwd And it revealed many accounts and their respective directories. Is my shared server secure? Does this tell anything? Can a good hacker access my directory from ...
1
vote
1answer
219 views

Privilege escalation in Linux 2.6.32

I am in an audit and I need to show the client that privileges can be scaled but I have tried in various ways and I could not. The Kernel version is 2.6.32-754.3.5.el6.x86_64. I have already tried ...
1
vote
0answers
76 views

Command line tools exploitable on linux

I'm looking this interesting project https://gtfobins.github.io/ But I don't understand some assumption. For example, if you consider the mv command: https://gtfobins.github.io/gtfobins/mv/ They ...
1
vote
1answer
79 views

Is there a list of safe/normal/expected SUID files?

Exploitable SUID executables are a basic privilege escalation vector. But just doing a search for all such files turns up a bunch of results on any linux system, most or all of which are presumed to ...
63
votes
4answers
12k views

Are most Linux systems that allow non-root users to execute code straightforwardly rootable?

long story short if you can execute code on a box it is usually straightforward to get root (quote source) The immediate implication of this quote (if it's accurate) is that if you're running a ...
0
votes
2answers
227 views

Privilege Escalation: C functions setuid(0) with system() not working in Linux

Quick disclaimer: I fully understand that the code I am attempting to write is insecure, and allows for arbitrary users to escalate to root. I am writing a simple C program like this to demonstrate ...
0
votes
1answer
69 views

Harden against privilege escalation in Microservices

Please consider the following scenario. The system has a set of business owners (i.e. users of the system) Each business owner is mapped to a set of customers The business owners login to the system ...
5
votes
5answers
186 views

Unix Privilege Escalation: “sudo must be owned by uid 0 and have the setuid bit set”

It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error: "sudo must be owned ...
2
votes
1answer
386 views

Running Docker container as Root user

Running a Docker container process as root inside the container is considered insecure. But I have some doubts that I need to clear: Is it still the same kind of insecure even if the container cannot ...
34
votes
2answers
3k views

Why is SUID disabled for shell scripts but not for binaries?

While I understand the idea of SUID is to let an unprivileged user run a program as a privileged user, I have found that SUID usually doesn't work on a shell script without some workarounds. My ...
1
vote
3answers
112 views

Is there a way to overwrite a file being used by a service without service management permissions?

I am trying to demo an exploit and here is the scenario: A service is running with SYSTEM privileges where the executable it is running (binpath) can be modified by any user. The exploit consists of ...
2
votes
2answers
116 views

Privileges needed to perform process injections

I am reading about process injection techniques on Windows machines (originally came to this from privilege escalation research). Although I used Windows for the majority of my life, I feel like I ...
3
votes
0answers
230 views

Exploiting Environment Variables in Scheduled Tasks for UAC Bypass

I am trying to escalate privileges from an ISS user on Windows Server 2012 R2 by exploiting Environment Variables in Scheduled Tasks for UAC Bypass as the following link explains the exploit: https://...
0
votes
3answers
191 views

Is it risky to mount tmpfs volumes in Docker?

Sometimes I need to run I/O intensive operations in memory. The tmpfs facility works really well for this, but I was wondering if there are any big risks of using tmpfs mounts inside a container. Can ...
0
votes
1answer
100 views

Is it normal to being able to kill a process from outside a container?

Situation: on user@host a qemu run and stack inside a container user@container Is it normal: to view with ps aux | grep qemu from user@host that the process run on user@container? to be able to ...
0
votes
0answers
326 views

Does LocalAccountTokenFilterPolicy registry value completely mitigate Windows pass-the-hash (PtH)?

I've been sitting for hours trying to get PsExec and windows/smb/psexec to work without luck, always getting the "Access is denied." error, until I came across the following article on Windows Vista: ...
3
votes
2answers
399 views

Which Linux commands can execute user-supplied code? [closed]

As explained here (https://www.helpnetsecurity.com/2014/06/27/exploiting-wildcards-on-linux/), the tar command can be used to execute arbitrary code. Is there a list of Linux commands, preferably ...
1
vote
0answers
70 views

Windows Possible Vectors for Privilege Escalation From “Weak” Folder ACLs

I am doing a security analysis and I am trying to figure out what the possible attack vectors and possibility of privilege escalation's are of the way this program is setup? I used Attack Surface ...
0
votes
0answers
362 views

Windows limited shell escape

I still cannot understand one concept of Windows system exploitation. There are many ways to get a shell on Windows machine - BO exploit, Web reverse shell, .exe launch. After that you gain a non-...
6
votes
2answers
446 views

Do sudo and .profile/.bashrc enable trivial privilege escalation?

First of all, let me mention that I’m assuming a configuration as set up by current Linux desktop distributions (e. g. Debian, Fedora). I’m sure that there are methods which, if implemented, would ...
1
vote
2answers
472 views

Shellcode does not execute as the owner

(This is a question regarding a challenge in a wargame on overthewire.org called Narnia) Here is the source code of the vulnerable script "narnia1" I intend to exploit: #include <stdio.h> int ...
1
vote
0answers
74 views

SUID not executing as root [duplicate]

I am trying to learn about SUIDs and have run into bit of a stumbling block - I have a ubuntu 16.04 system. I have set a few default binaries such as vim, find et al. to have SUID permissions as ...
2
votes
1answer
584 views

Why is the setuid bit not working when I execute this binary?

I am currently going through the Narnia challenges on overthewire.org. For the 1-->2 challenge, I am running into an issue that I can't seem to get around. Basically there is a C program called ...
2
votes
2answers
652 views

Privilege Escalation Wordpress

I have access to a Wordpress blog and want to read the server's /root directory that belongs to the user "root" and not "www-data". I also know his password, but I can't open an interactive shell to ...
-1
votes
1answer
149 views

How can I protect my cloud processing from everyone … even those with root access?

How can I run my top secret code and data on any cloud hosting provider such that everyone even the hosting vendor with root is denied access ? ... a research proposal What is the current state of ...
0
votes
0answers
160 views

Why does Ubuntu deem 16.04 un-affected by CVE-2017-16995(Kernel Privilege Escalation) while it's not?

In both current OVAL definition and CVE Tracker, it says for Ubuntu 16.04 While related to the CVE in some way, the 'linux' package in xenial is not affected. But I have tested many kernel ...
8
votes
3answers
347 views

How do I create an invisible and persistent user on linux?

For my software security class we are required to hack into a server created by our professor. I have hacked into the server, and have the password for the root user. Now that I am root, I would ...
2
votes
0answers
38 views

What potential security issues running sandboxd as root?

I have noticed that MacOS is running its sandbox process under the root user. This implies that any sandboxed process, assuming that it can escape the sandbox, would then have root privileges. Am I ...
6
votes
2answers
2k views

What does this sudo -l output mean and can this be priv. escalated?

I am trying to do priviledge escalation of a linux box. My sudo -l output shows the following : www-data@box:/scripts$ sudo -l sudo -l Matching Defaults entries for www-data on box: env_reset, ...
0
votes
1answer
465 views

What is the difference between privilege escalation and authorization bypass?

As I understand when a user with low privilege does some actions only available for users with high privilege this is called privilege escalation. And authorization bypass is when I do some actions ...
8
votes
1answer
2k views

Is it secure to mount Veracrypt without sudo password in this way

Does this way have any security issues other than what's mentioned in that post? For reference: Create a new group called say veracryptusers and give it the necessary permissions to use VeraCrypt ...
2
votes
1answer
451 views

How detrimental is a NULL pointer dereference vulnerability today?

Recently I have been reading about the implications of NULL pointer dereferences in kernel code (often LKMs/modules), specifically escalating privileges to root via mmap()ing the NULL page and then ...
3
votes
1answer
2k views

How to use a sh SUID script to get privilege escalation?

As www-data user (non-privileged user) I have found this SUID, world-writable shell script: www-data@Cisco:/home/cripto$ ls -al /etc/init.d/admin -rwsr-xrwx 1 root bob 233 Nov 12 13:09 /etc/init.d/...
1
vote
1answer
82 views

Unable to replace linux binary

I'm working on a linux privilege escalation. This is the situation: I'm able to write to /bin, and I only have sudo access to run a script. This script just prints information with an echo. I copied ...
2
votes
2answers
722 views

Debugging SUID for privilege escalation

When doing privilege escalation, assuming an application with the SUID set and a debugger, what stops us from starting a shell from within the debugger? I mean just write the shell code in an ...
1
vote
0answers
25 views

IBM OS/400 - What is the risk of the object authority *ALL on user object?

During a review of an IBM OS/400, I noticed that some objects representing users had the object authority *ALL for the user *PUBLIC. What is the risk of having an object representing a user with the ...
6
votes
0answers
324 views

Can any of the INTEL-SA-00086 vulnerabilities be exploited by an unprivileged user?

Several of the latest Intel Management Engine vulnerabilities are listed as local vulnerabilities, allowing code executing on the system to elevate its privileges to ME context. One of them (CVE-2017-...
1
vote
1answer
153 views

What is a safe way to exit a user's shell?

If I change to a potentially compromised user in Unix, for example by using su or sudo -i, then exit with exit, the compromised user could alias exit to something which drops me into a fake shell ...
2
votes
2answers
817 views

Windows Privilege Escalation system shell dies quickly

I have a user restricted shell and I used a host upnpn exploit which gives me root access to nc.exe. I am able to get a shell as SYSTEM but it dies after 30 seconds due to the service being ...
1
vote
0answers
789 views

Trick needed to make use of a local buffer overflow vulnerability to obtain root

I am working on a certain CTF trying to gain root privileges in it, I found a vulnerable program to buffer overflow vulnerability with Non executable stack security level (NX), I developed an exploit ...
4
votes
1answer
247 views

What are escalation pathways from a VM to its host?

If I want to check out a dodgy link from a friend, I've started opening these in a virtual machine. I'm assuming that if the VM gets hacked, the host where I do internet banking etc will still be fine....
185
votes
6answers
29k views

Isn't Ubuntu's system prompt for my password spoofable?

Sometimes, Ubuntu shows the following window: This window can be caused by some background processes running, such as an automatic update, or a process which reports bugs to Canonical which manifests ...