Privilege Escalation
Now that we have developed an efficient way of interacting with the system,
we should focus our attention on escalating our privileges
to gain root access.
Unfortunately, without build tools or the ability to transfer files,
because we’re simulating a disconnected physical kiosk,
this may prove to be difficult.
One approach is to leverage the
Basic Linux Privilege Escalation techniques
outlined by g0tmi1k.
In this document, he lists several commands we can use for enumeration,
including a find command that locates suid binaries.
Upon further examination, only mtr,
and xlock have recent vulnerabilities.
However, none of those vulnerabilities affect our specific versions.
It would be difficult and time-consuming
to exploit these binaries without debugging tools
so we’ll try another approach.
The ps aux command lists all running processes.
Based on this output, it seems the kiosk is running a number of root processes
which we may be able to use to escalate our privileges.
One of these processes is “openbox”,
the X window manager used by the kiosk’s custom interface.
This finding warrants further investigation.