All right.
So now that we've explored the frequently exploited Linux
services and we've taken a look at how they can be exploited,
we can now move on to the next section within this course.
And that is the Linux privilege escalation section,
where we will be exploring some of the inherent vulnerabilities
that can be exploited on a Linux system
in order to elevate your privileges.
All right, so we're going to start off with Linux kernel
exploits, and we have already explored Windows kernel
exploits.
And really, the process is fairly similar,
and I'm going to be walking you through that right now.
So again, I've already explained what
a kernel is during the Windows privilege escalation section.
In regards to Linux kernel exploitation,
it's very important to understand what's going on.
So kernel exploits on Linux will typically
target vulnerabilities in or within the Linux kernel
in order to execute arbitrary code in order
to run privilege system commands or to obtain a system shell.
So we're essentially trying to identify a vulnerability
within the actual Linux kernel that's
running on the Linux target or the actual Linux server
or Linux system.
And of course, this particular kernel vulnerability
has to, again, provide an attacker
or to provide us with the ability
to execute arbitrary code.
And of course, this code is going
to be executed with elevated privileges.
Now, it's very important to understand or to note
that this process will differ based on the kernel
version and the distribution being targeted
and the kernel exploit being used.
So on Windows, it's fairly straightforward
because you have specific versions of-- or editions
of Windows ranging from Windows 7 to Windows 10 and even older.
And then each of these operating systems or versions of Windows
have a specific build versions.
And based on that information, we
utilized a tool called the Windows Exploit Suggester that
essentially checked the current state of the Windows operating
system that's being targeted and actually took
a look at the hotfixes that were installed and used
that information to determine what this system is
vulnerable to in regards to kernel exploits.
Now, the privilege escalation process on Linux systems
will typically follow the following methodology.
So we'll start off by identifying
kernel vulnerabilities.
And this will be facilitated through the use
of an automated script called the Linux Exploit Suggester.
And once we have identified a kernel exploit that, again,
will work on the specific kernel version and distribution
release version that is running on our target,
we can then download the exploit code, which is typically
going to be in C. And we will also need to compile it.
So I'll take you through the compilation process.
And then we need to transfer it over to the target system
and execute it with whatever arguments or parameters
you need to specify.
All right.
So as I said, the tools and the environment that we'll be using
will essentially revolve around the Linux Exploit Suggester.
So the Linux Exploit Suggester is very, very, very similar
to the Windows Exploit Suggester and is
designed to assist in detecting security deficiencies
for given Linux kernel and Linux-based systems
or machines.
It assesses, using heuristic methods, the exposure
of the given kernel on very--
on every publicly known Linux kernel exploit.
So you can check out this particular tool.
The GitHub repository is linked below or within the slides.
And again, one thing to note is that I'm
going to be performing these techniques within my own home
lab given the nature of kernel exploits,
and they're being performed on an Ubuntu 12.04 VM.
All right, so one thing that I need
to caution you on as I did within the Windows video
is that kernel exploits are targeting
the actual kernel, which is the core of the operating system.
And as a result, if you run any kernel exploits that are not
compatible with the specific version or the specific kernel
version running on the target, then you
can cause crashes or kernel panics
which can lead to data loss.
So again, be very careful with the types of kernel exploits
you run, especially in a production or enterprise
environment because this is something
that you want to avoid happening.
You never want to be in a position
where you have actually caused data loss
by running a kernel exploit.
So be very careful with kernel exploits.
With that out of the way, as I said,
this video doesn't have a lab environment attached to it.
You can follow along with the techniques.
Essentially what I'm trying to demonstrate
here is the actual methodology and the tools
behind the methodology, so from identifying kernel exploits
or kernel vulnerabilities to compiling kernel exploit code
and then transferring it over to the target.
So again, it really doesn't matter
what exploit is being used as long as you
understand the methodology and the tools behind the process.
All right, so I'll see you within my Kali Linux VM.
All right.
So I'm back within my Kali Linux VM.
And I've already obtained a meterpreter session
on the target.
So let's perform some local enumeration.
So if I type in sysinfo, you'll see that the target is running
Ubuntu 12.04, and the Linux kernel is 3.2.0-23-generic.
It is a 64-bit operating system, and our meterpreter session
is a 32-bit meterpreter session, which really doesn't matter
in this particular context.
Well, you might be asking yourself, well,
what are your current privileges?
Well, I can say get user ID.
And you can see I'm currently logged on
or I currently have access to the target system
with the privileges associated with the user account www-data.
So this is a service account that you'll typically
find on Linux systems that have a web server
or that are hosting a web server.
And this is a service account because it's essentially used
to manage the actual web server, whether it be Apache or NGINX.
And it is, generally speaking, unprivileged given
the fact that if you exploit the web application or the web
server, then this account is essentially there
as a safeguard.
And as a result, it is not part of the pseudo group or any
administrative group on the Linux system and cannot execute
any commands that require root privileges.
So I can verify this by opening up a shell session,
and I'll obtain a bash session here, so I'll say /bin/bash -i.
And again, if I list all the groups
that www-data is a part of, you can
see that it's only a part of its own group.
And you can list out the users.
So I'll list all the users on the system.
There we are.
So you can see that we have a few user accounts.
We have the root user account.
We have a user account called sumo,
and then we have the service account right over here.
So that's www-data.
All right, and that is an unprivileged account.
So if we try and say sudo apt-get update--
if we try and update our repositories--
you can see that we are--
it's going to ask us for a password.
But because this is a service account,
it's going to tell us right over there no tty
present and no askpass program specified.
What that really means is that we
need to elevate our privileges.
And we are targeting the root account
as that is the account with the highest privileges on a Linux
system.
So this is our target.
All right, and the way we're going to obtain a root access
is through the use of a kernel vulnerability or a kernel
exploit.
So what I'm going to do is I'm just
going to terminate this particular channel.
And I'll just clear up my terminal.
So as I said, the script we're going to be utilizing
is a script called the Linux Exploit Suggester,
and the GitHub repository is highlighted or added
in the slides.
And it's really very simple in regards to using it.
You can see it's a shell script.
And all you need to do is just utilize the Quick Download
option here, so wget, and it'll save it
as a script called les.sh, as you can see right over there.
All right, so that stands for linux-exploit-suggester.shell.
So I would recommend downloading this onto your Kali Linux
system or your penetration testing distribution
and then transferring it over to the target system.
In this case, because we have a meterpreter session,
we can easily transfer it over to the target system.
What I'm going to do is I'm going
to navigate to the Temp directory
within the Linux file system.
The Temp directory is very similar to the Temp directory
on Windows.
It's essentially a directory that stores temporary files.
If I list all the contents of this directory,
you can see that we just have a random file there.
That's really not pertinent to the actual kernel exploitation.
So I've already download the Linux Exploit Suggester script.
So I'll just upload it, and I'll specify where it's stored.
In my case, it's stored on my desktop
under Linux-Enum and les.sh.
So I'll upload it.
That is uploaded successfully.
And I'll open up a shell session now
because I want to execute the script.
So I'll say /bin/bash -i.
I'll then provide the script with executable permissions.
We can see it right of here.
In order to do that, I'm going to say chmod +x,
so I'm providing this file with executable permissions,
and then les.sh.
There we are.
If I now lists of the contents of this directory,
you can take a look at the permissions here.
You can see that we have the ability to execute it.
So we can execute it by saying les.sh, and I'll hit Enter.
And you want to give this a couple of seconds.
There we are.
So it's enumerated a list of vulnerabilities
that essentially or rather a list of exploits
that this particular version of Ubuntu
or this specific version-- the specific kernel version
is vulnerable to.
Right now, you can see right over here
that it will display really important information
like the kernel version, the architecture, the distribution,
and then the distribution version.
So in terms of kernel exploitation on Linux,
this is really the most important piece of information,
or really these are the most important pieces
of information.
And you can see it's going to search among 76 kernel space
exploits and 48 user space exploits.
Don't worry if it gives you the actual write error
broken pipe, or rather the broken pipe error
right over here.
So getting started, you can see that we
have a list of exploits or vulnerabilities
and their respective CVE identifiers.
And the way this script works is the exploits listed
at the very top are the ones with the highest chances
of success.
However, you need to take a look at the information listed here.
So firstly, for a particular vulnerability or exploit--
in this case, we have the dirtycow exploit,
which is exactly what we're going to be taking a look
at-- it will provide you with details regarding this
vulnerability, the exposure of your system to this or rather
the exposure of the target system to this particular
vulnerability or exploit--
in this case, you can see it as highly probable--
and then the tags.
This is very important.
So the tags essentially give you information regarding
what distribution release version and kernel
version this particular exploit is essentially
or this particular vulnerability can be exploited on.
So, for example, you can see it says right over here
Debian 7, 8 Red Hat Enterprise Linux version 5 and then
specifies the kernel that this exploit will work on.
In our case, you can see that it's
highlighted in yellow right over here
that Ubuntu 16.04, 14.04, and 12.04 are all
vulnerable to the dirtycow exploit.
And that is the most important piece of information.
The other great thing that it also provides you with
is the download URL for the exploit code,
which is an Exploit-DB link, which is trustworthy.
However, I recommend going through the exploit code
yourself manually and verifying that it's not
doing anything malicious other than what it is intended to do.
And again, in this case, we are going
to be utilizing the dirtycow ex--
the dirtycow 2 exploit.
So again, you can get information regarding
the vulnerability here.
And we can see that it works on the current version of Ubuntu
that is running on the target as well as the actual kernel.
So what we can do is if we take a look at the download URL
here, that's the Exploit-DB link which I'll just open up
within my Firefox browser.
You can see I have it right over here.
So this is the Linux Kernel version 2.6.22 or any Linux
Kernel less than 3.9.
The name of the vulnerability is called Dirty COW,
and the way it works is fairly simple.
Let me just open the actual disclosure site or a reference
to this particular vulnerability.
You can see that the Dirty COW exploit
is a privilege escalation vulnerability in the Linux
Kernel.
And you can view the details regarding
this particular vulnerability.
So there we are.
A race condition was found in the way the Linux Kernel memory
subsystem handled the copy-on-write breakage
of private read-only memory mappings.
All the information we have so far is included in this page.
So impact-- an unprivileged local user
could use this flaw to gain write access
to otherwise read-only memory mappings
and thus increase their privileges on the system.
And the exploit code here is quite ingenious
because it essentially utilizes that vulnerability
and allows you to create a privileged user account.
And the default user account that it actually
specifies is called firefart.
So what it does is--
again, all you need to do is just compile this exploit code.
Once it's compiled, you'll then be
provided with the exploit binary, which you can then
transfer over to the target.
And then you can run the newly created binary
by either doing--
by the running dirty or running the dirty command
and specifying a password for the user firefart.
Now, you can actually customize the actual username
and change it from firefart to anything else that you'd like.
And again, this is fairly simple to run.
So what we're going to do is I'm going
to download this exploit code from Exploit-DB.
There we are.
I'll just click on the Download link,
and I'm just going to give Exploit-DB a couple of seconds
because it usually has a delay.
All right, so it's prompting me to download the C code
or the C exploit code which is written in the C programming
language.
So I'll just hit OK.
That's going to save it within my Download directory.
Now, in terms of compilation of the actual exploit,
there are a few things or a few techniques that can be used.
The first technique is to compile it locally
on your Kali Linux or penetration testing
distribution.
Or you can transfer it over to the target system
and compile it on that system.
Now, in order to compile C code on Linux,
you will need the GCC package, which is the GNU C
compiler, installed.
And you can install that fairly simply on your Kali Linux
system by opening up a new tab.
And you can simply say sudo apt-get install gcc,
and I'll just paste in my password here.
And I should have the latest version.
In this case, it looks like I have a few updates.
I'm going to skip those updates because the version I
have running right now is quite stable.
So now that we've downloaded the exploit code--
it's currently within my Downloads directory.
So I'll just navigate to that Downloads directory there,
and I have the Windows exploit executable here or privilege
escalation kernel exploits.
So I'll just remove that.
And if we follow the compilation instructions,
we need to use GCC and then pthread,
specify the actual name of the exploit file, which
is, in this case, dirty.c.
So we can actually rename that.
I don't need to rename it.
However, in this case, it'll make a lot of sense.
So I'll rename this into dirty.c.
Sorry, that is, we need to move it, not remove.
So I'm just going to say move.
Let me type that in correctly.
For some reason, I can't type in correctly.
Did we delete it?
Yeah.
So I'll need to download it again.
So I'll just download the exploit again.
There we are.
Save file and I'll just move it or rename it.
So there we are, and I'll call it dirty.c, or-- yeah,
we can just call it dirty.c.
There we are.
And we can now run the actual GCC command here.
We can just copy directly.
And again, in some cases, the Linux kernel
exploit code will not have compilation instructions.
So you might have to research that.
So I'll just paste this in here.
We'll hit Enter.
And we get no error messages, which
tells us that the dirty binary has been compiled.
That's the one there.
And we can now transfer this over to the target system,
and let's see whether it works.
If it doesn't work, then we'll need
to compile the C code on the target system.
So I'll just terminate this channel and head back over
into my meterpreter.
And I'll upload the actual binary, the compiled binary.
So I'll say, this is under my Downloads directory,
and I want to download the dirty binary there.
There we are.
So that's downloaded.
So what I can do is open up a shell session,
and I'll say /bin/bash -i to get a bash session.
And I can then provide it with executable permissions.
So we'll say chmod +x dirty, and then we can execute it,
so dirty.
And we can provide a password as specified within the actual run
command here.
So we can say dirty new-password.
So I can say, for example, password123, hit Enter,
and you can see we get a few errors here.
So this is because the exploit code was not
compiled on this system.
So what we'll need to do is I'm just
going to remove the dirty binary here.
And I'll head back over into my meterpreter session,
and I'll upload the C code.
So that's on the Downloads, and that is dirty.c.
I'll upload that to the target, open up a shell session there.
And I can now compile it using the same instructions,
so again, gcc, and I'll paste that in there.
Hit Enter.
That compiled successfully.
So chmod +x, and we say dirty.
There we are.
And we can then execute the dirty binary
and specify the password, so password123.
Hit Enter.
And we want to give this a couple of seconds.
If successful, it should actually give you
a message that highlights that.
So I'm just going to give this a couple of seconds.
All right.
So after a couple of seconds, you can see right over here,
if we take a look at the output, it'll
tell us that was successful.
So there we are.
So you can see /etc/passwd successfully backed up
to /tmp/passwd.bak.
So it'll actually take a backup of the original password file.
It'll say please enter new password, password123,
which we entered.
And it created the firefart user,
and it provides us with the actual user information.
There we go.
And you can see right over here, it tells us done.
Check the /etc/passwd file to see if the new user was
created.
And then you can log in with the username firefart
and the password password123.
So what I'm going to do is display the contents
of the password file here.
And there we are.
We can see the firefart user was created,
and this is a privileged user.
So what this means is that we can essentially log into it,
and we will have root privileges.
So we can say switch user or su and firefat.
There we are.
And you can see it's telling us must be run from terminal.
Now, this particular target is actually running SSH,
so I can actually log in with SSH.
So I'm just going to open up a new tab.
So I'll say ssh firefart@ the target IP, which, in this case,
is 10.10.10.15.
There we are.
So it looks like we have a few issues here.
So it's telling us it's possible that someone
is doing something nasty.
So let's actually remove the actual key, the RSA key,
that's currently within my known hosts file.
There we are.
That's not a problem with the target.
There we are.
So it's going to ask us whether we
want to accept the fingerprint.
And the password was password123.
Hit Enter, and we log in as the user firefart,
and I can now run administrative commands.
So I can say sudo apt-get update.
There we go, and it's saying the unknown user root, so unable
to initialize the policy plugin.
So we can say apt-get update.
There we are, and that works out just fine as we can see there.
And of course, don't worry about the errors associated
with the actual repositories there but
the objective or rather the highlight
being that we have obtained administrative privileges.
So again, I can say who am I?
As you can see, firefart there.
And if we try and list out a file that
is only accessible by root users or users
with root privileges like the shadow file,
you can see I can access it here.
And we'll be exploring the shadow file within the Linux
credential dumping section.
So this contains the hashed passwords, the hashed Linux
user account passwords.
And this, as I said, this file is only accessible by users
with root privileges.
So that is how to elevate your privileges on a Linux system
through the use of a kernel exploit.
And as I said, this particular video
is really not about this particular system
or the exploit that we just used.
I primarily wanted to highlight the process of utilizing
the Linux Exploit Suggester to identify potential kernel
exploits that you can use and then how to identify
the correct kernel exploit code to use and how to compile it,
how to transfer it over to the target,
how to deal with specific issues that you might face
during compilation of the exploit code, and then,
of course, executing it, which was fairly simple.
All right, so that is going to conclude
the practical demonstration side of this video.
All right.
In the next video, we will be exploring
the process of elevating our privileges
by exploiting misconfigured or insecure Cron jobs.
So I'll see you in the next video.