Questions tagged [privilege-escalation]
Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access throughout the environment
191
questions
0
votes
0
answers
18
views
what are legitimate reason for a program to need access to /proc/self/mem [migrated]
I have noticed that both browsers Firefox and Chromium on linux do open the file /proc/self/mem for reading. No other program on my system reads this file, as far as I can tell.
/proc/self/mem is ...
- 223
1
vote
1
answer
43
views
Privilege Escalation
Suppose I have an Admin account and a normal user account. There is some functionality that is only accessible to the admin only, like promoting other users. In this scenario, I captured a request ...
0
votes
0
answers
12
views
Online Judge running on root [duplicate]
My college has a website which allows students to submit coding assignments by running them on an Online IDE which checks the output against several test cases.
I noticed by running system(“whoami”) ...
- 1
0
votes
1
answer
99
views
Vulnerability in the source code, but can't elevate do Privilege Escalation
Playing a CTF, I am trying to gain access to level 3 (you have to gain access sequentially from level 1 to level 2 and so on...), and in the level 2 directory there's this source code 2.c and along ...
- 11
1
vote
1
answer
65
views
Rowhammer mitigations in current hardware and software
I've been looking into rowhammer attacks and mitigations and there are two (what seem to be) mitigations that I've seen that are actually implemented in currently available hardware and software, but ...
- 11
0
votes
0
answers
30
views
Local privilege escalation - DLL Hijacking questions
I have a couple of questions regarding LPE techniques, and especially DLL hijacking (as there are at least 6 variants).
I was reading that DLL hijacking is an old vulnerability, but surely, this is ...
- 1
1
vote
1
answer
249
views
Abusing Shell Feature for Privilege Escalation
This was covered in Linux PrivEsc, task 15, in this TryHackMe room.
I am having trouble understanding how this debugging mode is executing the commands in the PS4 variable, and why I must put /usr/...
- 181
0
votes
1
answer
102
views
Legitimate use cases for writable etc/passwd files
I´m learning about linux privilege escalation via a writable /etc/passwd file and was wondering how common that actualy is?
Are there any use cases where a regular user might have (or even needs) ...
-1
votes
3
answers
223
views
What prevents Windows from being as secure as Linux? [duplicate]
According to wikipedia, Linux's security compared to Windows is generally due to "the malware's lack of root access."
Why doesn't Windows just fix this?
- 7
0
votes
1
answer
74
views
Is there any way to disable/not allow unquoted service paths in Windows?
Unquoted service paths might be used as a privilege escalation vector after an attacker gains access to a Windows host.
Given Hector's answer in the following question:
"Windows Unquoted Search&...
- 133
1
vote
1
answer
94
views
Can I escalate my privileges if I have read-write access to IAM service in AWS?
We are trying to convince folks in our company to grant developers full privileges to all services in "dev" account (current policy does not allow developers to create anything in our AWS ...
- 113
1
vote
0
answers
91
views
Why can't I access /tmp after my execve(/bin/sh) exploit? [closed]
I succesfully tried to exploit an old version of Apache. A shell is spawned with user www-data (id=33), but I can't "ls" or "cat" anything in /tmp. I can ls the contentns of /bin ...
- 11
6
votes
3
answers
751
views
At which OS privilege level log4j usually runs?
Considering that a RCE vulnerability has been recently found in the log4j library, a library used in a lot more applications than I thought. The following question comes to my mind.
If an attacker ...
- 181
2
votes
2
answers
214
views
Privilege escalation : Is this step really necessary?
I understand the LD_preload trick, but in this tutorial(https://www.hackingarticles.in/linux-privilege-escalation-using-ld_preload/), they not only give the user the right to keep this environment ...
- 143
0
votes
1
answer
211
views
Can a process executed as Root do ring 0 stuff?
I know that ring 0 is a CPU concept, but are processes running as root allowed to run instructions that require ring 0 such as changing the cr3 register for the page table ?
- 3
2
votes
1
answer
159
views
Why is sudo's usage of timestamp files insecure?
Sudo and Opendoas on Linux use timestamp files to keep track of how long it's been since you've last entered your password. Doas on BSD uses a kernel feature instead.
Why is the latter considered more ...
- 23
0
votes
1
answer
197
views
Understanding the Meltdown vulnerability
I need to write a simple program that demonstrates a race condition. I picked the Meltdown vulnerability.
I want to clarify something. I'm following this explanation https://resources.infosecinstitute....
1
vote
0
answers
88
views
Authorise access to hierarchical data
Consider a scenario in which you offer service access based on a hierarchy of authority. i.e., a HEAD can register his subordinates. The authenticated HEAD has the previledge to read and update data ...
- 121
2
votes
1
answer
323
views
If browsing the web with root is dangerous, isn't browsing the web with a sudo enabled account only marginally safer?
If I get hit with malware while performing daily tasks (e.g. - checking email, web browsing, etc.) with a root shell, the malware will own my machine.
If the aforementioned occurs whilst on a standard ...
- 43
-1
votes
1
answer
241
views
PowerShell - privilege escalation [closed]
In the past, I have used the Sherlock PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities.
However, I am looking for a similar script, but I ...
1
vote
1
answer
499
views
Secure way to run a linux binary which needs access to ressources only available to root?
As a developer, I ask how to approach security concerns regarding permissions of a binary which needs access to resources only available to root users.
For example, let's think of a simple tool which ...
- 111
0
votes
0
answers
344
views
Sudo -l systemctl bypass
I am trying to privilege escalate a vulnerable box and I've stuck with this output:
sudo -l
Matching Defaults entries for charlie on sewers:
env_reset, mail_badpass,
secure_path=/usr/local/...
- 1
1
vote
1
answer
659
views
SUID Priv Escalation - LD_LIBRARY_PATH versus ldconfig and /etc/ld.so.conf
Background
Currently doing some vulnservers on Offensive Security's Proving Grounds Practice Labs. A vulnserver is a machine configured with vulnerabilities for testing/audit and research purposes.
I ...
- 345
1
vote
1
answer
134
views
How to fine tune timing for CVE-2021-3156 (sudo privilege escalation)?
I am trying to execute the sudo buffer overflow (CVE-2021-3156) on one of my systems, but haven't got it working yet. The system is definitely vulnerable (taking into account sudo version and sudoedit ...
- 166
1
vote
0
answers
321
views
Spawning child processes from root using runuser command
I am working as an intern for an online coding platform startup (similar to LeetCode or HackerRank).
The backend is written in Nodejs. Instead of running the code in a sandbox of some sort, the lead ...
- 113
0
votes
2
answers
778
views
Is there a way to change your current UID to equal your EUID?
Here is the scenario:
running id gives this :
uid=1001(test1) gid=1001(test1) euid=1000(bl4ckc4t) groups=1001(test1) -
This means that I am user test1, but my euid is set to another user.
My goal is ...
- 3
0
votes
1
answer
528
views
Privilege escalation using symlink [closed]
I am working on a "Hack me" challenge, I have access to apache account in the server, I tried to get root access, I run linpeas.sh script and linpeas didn't find anything special, however, ...
1
vote
1
answer
924
views
How to run PrintSpoofer in memory from powershell?
PrintSpoofer uses named pipe impersonation to elevate on Windows 10 to SYSTEM from a user with SeImpersonatePrivilege (Local Service, Network Service, Administrator etc.). The compiled version is ...
- 123
1
vote
1
answer
206
views
Prevent a remote privilege escalation when the root/admin password is known
Consider the following Linux system:
root account is disabled (passwd -l root, passwd -d root),
there is an account 'admin', with sudo rights,
there is an account 'webservice', with limited ...
- 111
1
vote
2
answers
3k
views
Sudo "/usr/sbin/halt", "/usr/sbin/reboot", "/usr/sbin/poweroff" - how to leverage it to privilege escalation?
A normal user can execute these commands as root without providing any password (sudo includes the full path of the command so path hijack isn't the case here), could "halt", "reboot&...
- 21
2
votes
1
answer
186
views
Possible to inject in the middle of a ROOT NOPASSWD command with a wild card?
I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands ...
- 41
0
votes
2
answers
2k
views
How safe is it to use SMB file share on a machine running up-to-date Windows 10 LTSC through the Internet?
Running Windows 10 LTSC. Forwarded 445 port on the router to Windows SMB.
Assuming that:
My machine has no viruses in it (fresh Windows installation)
It has been updated to the latest OS release
I am ...
1
vote
0
answers
95
views
Running non-root process in docker vs bare metal
Recently I faced argument that threw me a bit off balance. I've been suggested that running application bare metal is actually more secure than running it in container.
Reasoning behind that is that ...
- 217
0
votes
0
answers
998
views
Exploit apache2 service as member of www-data group
I am attempting to solve a CTF challenge where I am logged in as a member of the www-data group and the apache2 service is misconfigured and can be run as sudo without a password. What I am attempting ...
0
votes
1
answer
501
views
Linux: Can unprivileged users tamper with processes running under their own identity?
Having the following pseudocode executed by a superuser, is it safe to assume that it is secure on Linux?
if fork() == 0:
# drop privileges to an unprivileged user, let's say "nobody"
#...
- 101
0
votes
0
answers
248
views
How can I use nohup command to get root access of the target machine?
I am playing ctf and I have gained access to the target machine but not as root. I can see nohup utility has root access on the machine and I used this command to get the root access but that did not ...
- 1
1
vote
1
answer
163
views
Host filesystem manipulation from docker vs. virtual machine
When reading about docker, I found a part of the documentation describing the attack surface of the docker daemon. From what I was able to understand, part of the argument is that it is possible to ...
- 111
0
votes
0
answers
101
views
Taking over Windows DC as a domain user
What do you suggest in order to take over a Windows Domain Controller, given the fact that you gained access to a domain user workstation and so you have domain user credentials?
I have domain user ...
- 49
1
vote
2
answers
1k
views
inject update-motd.d 00-header to run a script on ssh login
Is there a way to inject the 00-header to trigger a script that executes a shell upon ssh login.
I'm facing a scenario where the 00-header has root privileges and I can modify it. I'm trying to have ...
- 95
1
vote
0
answers
430
views
linuxpam-pam unix-security-bypass
https://exchange.xforce.ibmcloud.com/vulnerabilities/31739
linuxpam-pamunix-security-bypass (31739) reported Jan 23, 2007
Linux-PAM could allow a remote attacker to bypass security
restrictions, ...
- 95
1
vote
2
answers
320
views
I am a member of the Administrators group on a Windows 7 box, how can I spawn a reverse shell with elevated privileges?
I am learning Windows Privilege escalation. I've managed to add a user to the Administrators group but I don't know how to execute nc.exe, present in the Temp dir, with elevated privileges.
I am ...
- 11
111
votes
11
answers
47k
views
Is `sudo` almost useless?
Once an attacker has a shell as your sudoer user (or just compromised a local process enough), he/she can use one of the many privilege escalation tool to even automatically put themselves for example ...
- 1,197
2
votes
2
answers
3k
views
How do I know/find out about Minecraft Server Vulnerabilities?
I remember playing Minecraft (Java-we're only talking about Minecraft Java on the computer here) at like 13-14 years old, and having this server owner claim that the server has been hacked, and that ...
- 51
1
vote
1
answer
338
views
What does the following lines of code mean? Can anyone explain step by step? [closed]
I'm still learning and this was a part of using systemctl for privilege escalation.
eop=$(mktemp).service
echo '[Service]
ExecStart=/bin/sh -c "cat /root/root.txt > /tmp/output"
[Install]
...
- 13
0
votes
2
answers
1k
views
Exectuting sudo command in one line within a non-tty shell
I have access to a server via RCE over http. I can send post requests to the server which results in command execution. I am attempting to escalate privileges via sudo (su is not installed).
The ...
- 1
0
votes
3
answers
366
views
Does sudo ever de-escalate privilege while the program/command/service is running?
For Example
Is it safer to do:
$ sudo [cmd] [args] [enter user password]
or
$ su - [enter root password]
# [cmd] [args]
I always assumed they are the exact same thing, because sudo utilizes ...
- 345
0
votes
0
answers
649
views
Powershell (WinRM) and cmd.exe: reg query output deviation
during a CTF I encountered the following anomaly regarding PS & cmd.exe:
I got access to a Windows x86 server through WinRM Port 5985 using evil-winrm. (https://github.com/Hackplayers/evil-winrm) ...
- 1
1
vote
1
answer
386
views
Why not use sudo instead of setuid/setgid?
If it is an insecure practise to use setuid/setgid binaries, why do distributions, OSes force it?
The big question: what prevents using sudo instead of the setuid/setgid binaries?
"ping" would be ...
18
votes
1
answer
17k
views
How to do a privileges escalation with ping?
I am trying to achieve a privilege escalation. I have a virtual machine on Linux and I escaped from an rbash terminal. I have now a "normal" user terminal. My user is not in the sudoers file.
Is it ...
- 181
-1
votes
1
answer
1k
views
Privilege escalation modifying cookie
I have two accounts, an administrator and a simple user. I can capture the administrator's cookie and use it in a simple user request, I find myself logged in with the administrator user and then log ...
- 117