User Configuration Files
Let’s start by discussing some background information about Linux configuration
and its functionality,
which will help set the groundwork for our exploits later on in this module.
In Linux systems, applications frequently store user-specific configuration files
and subdirectories within a user’s home directory.
These files are often called “dotfiles”
because they are prepended with a period
The prepended dot character tells the system not to display these files in basic
file listings unless specifically requested by the user.
These configuration files control how applications behave for a specific user
and are typically only writable by the user themselves or root.
If we compromise a system under a given user, we can modify those files
and change how applications behave.
As a penetration tester, this provides us a useful attack vector.
Two common examples of dotfiles are .bash_profile and .bashrc.
These files specify settings to be used within a user’s shell session
and the difference between them is subtle.
.bash_profile is executed when logging in to the system initially.
This happens when logging in to the mac- hine itself, via a serial console or SSH.
.bashrc is executed when a new terminal window is opened from an existing login
session or when a new shell instance is started from an existing login session.
We can modify .bash_profile or .bashrc to set environment variables
or load scripts when user initially logins into a system.
This can be useful when trying to maintain persistence, escalate privileges,
or engage in other offensive activity.
Let’s take a look at an example.
In our lab machine, we’ll insert a simple command at the end of our user’s.bashrc.
This will echo a touch command to write a file called bashtest.txt,
and append that to the end of the user’s .bashrc file.
When the user begins a new shell session, our command will be executed.
The bashtest.txt file is not there at first ,
but once we start a new shell session,
the command is executed and the file is written to the /tmp directory as expected.
In the next section, we’ll use dotfiles to perform attacks and escalate privileges.