Root Shell at the Top of the Hour
To begin, we’ll remove the old symlink,
symlink our bookmark file to /etc/cron.hourly instead,
and again run openbox
We can verify our bookmarks file has been written to the new folder.
We should be able to run a gtkdialog terminal via this script
and it should run as root.
However, if our terminal is closed or crashes,
we’ll need to wait an hour to get another one.
Let’s give ourselves a backdoor to root access instead.
Earlier in the enumeration process, we discovered busybox
which provides various Unix utilities in a single file,
including command shells such as Bash.
Let’s copy this to guest home folder
using our gtkdialog terminal to preserve the original,
and create a cron script that will change the ownership of the file to root
and set it to SUID.
If this script is run as root,
it will allow us to run busybox with root privileges.
Our Scratchpad script will update the contents of our bookmarks file,
this time in /etc/cron.hourly.
We’ll make our setsuid script executable and run it.
After making our bookmarks.html script executable,
it will execute at the top of the next hour,
making our copy of busybox root-owned and SUID.
Good. Let’s try out our new, “upgraded” busybox.
According to the help output, we can run shell commands with the following syntax.
Trying to call gtkdialog directly using this method doesn’t seem to work.
We receive no response in our terminal and no gtkdialog window is displayed.
It’s possible this has to do with the way the commands are being interpreted
by the gtkdialog action and passed to the shell
but since we don’t receive any output or errors, it’s difficult to know.
To get around this,
we’ll create a script with Scratchpad that will launch our terminal.
Then, we’ll execute it with busybox:
This will display a new gtkdialog terminal window.
Let’s run whoami in our new terminal.
Excellent! We have a root shell!