[CLICKING]
[MUSIC PLAYING]
Exploiting SUID binaries-- all right,
so this is the final privileged escalation technique
that we're going to be exploring for Linux,
and it will involve the exploitation
of misconfigured SUID binaries.
So let's get an understanding of what SUID binaries are
or what the SUID permission is.
In addition to the three main file access permissions
on Linux-- you have your read, write, and execute--
Linux also provides users with specialized permissions
that can be utilized in specific situations.
One of these access permissions is the SUID permission, which
stands for Set Owner User ID.
When applied to a file or binary,
this permission provides users with the ability
to execute a script or binary with the permissions
of the file owner, as opposed to the user that is
running the script or binary.
SUID permissions are typically used
to provide unprivileged users with the ability
to run specific scripts or binaries with root permissions.
It needs to be noted, however, that the provision
of elevated privileges is limited
to the execution of the script or binary
and does not translate to elevation of privileges.
However, if improperly configured,
unprivileged users can exploit misconfigurations
or vulnerabilities within the binary or script
to obtain an elevated session.
All right, so let me use a scenario or example
to essentially explain this.
Now, I want you to think of a binary on Linux that actually
allows standard users or users to execute specific commands
with root privileges.
Well, one of these binaries is the sudo binary, right?
So the sudo binary allows users to essentially execute
specific commands with root privileges.
And, of course, they need to provide their password
that they need to be part of the sudo group.
However, that particular binary is owned by the root user,
and it is an SUID binary in that it
allows unprivileged users to execute that specific binary
with elevated privileges.
Now, again, this is something-- or this particular permission,
the SUID permission is, as I said,
typically used to provide non-privileged users
with the ability to execute a script
or binary with the permissions of the file owner.
And in this case, we're going to be
looking for SUID binaries that are owned by the root user.
Right now, as I said, as highlighted previously,
it's to be noted that the provision
of elevated privileges is limited
to the execution of the script or binary.
So it doesn't provide you with a free range or free-for-all
elevated session after executing the command.
It's only limited to the execution
of that specific binary.
However, we can find specific misconfigurations
or vulnerabilities within the specific binary
that's been configured with the SUID permission.
And if there are vulnerabilities that we can exploit,
then we can get that SUID binary to execute specific commands
with root privileges, consequently providing us
with an elevated session.
Now, in terms of the actual requirements
of what we're going to be looking for, in order
to exploit an SUID binary, in order
to elevate our privileges, the actual technique,
or this particular technique, will depend
on the following factors.
Number one, the owner of the SUID binary--
given that we are attempting to elevate our privileges,
we will only be exploiting SUID binaries
that are owned by the root user or other privileged users.
Secondly, the access permissions--
we will require executable permissions in order
to execute the SUID binary.
So we are really looking for an SUID binary
that is owned by the root user and that we can actually
execute with our current permissions, which
are not elevated.
And as I said, the objective here
is to identify or to find a vulnerability
within that binary that we can essentially take advantage
of and have the SUID binary execute
additional commands that will provide us
with an elevated session.
And the really ingenious ways of doing this-- as I said,
there's a lot of techniques and tools out there
that can be used to really execute quite a few SUID
binaries if they have been configured
with the SUID permission for that matter.
So we're not looking for standard binaries.
These binaries need to have the SUID permission applied to them
and the owner needs to be the root user.
So again, just keep that in mind.
Now the lab environment that has been attached to this video
will really highlight or showcase how this can be done,
and all you need to do is just fire up the lab environment
and I'll see you within the lab environment.
All right, so I'm back within the lab environment.
And again, in this case, you don't
need to gain access to a target system.
This is a very similar lab environment
to the previous video.
So you already logged on the target system
as the user student, who is not privileged.
And of course, if I say whoami, you can see student.
And if I view the groups that this particular user is
a part of-- so I can say groups student.
You can see that it's a part of its own group, which
is unprivileged.
It's really not part of the sudo group,
so we can't do anything that requires root privileges.
All right, so let's take a look at the SUID binary
that we will be exploiting.
So I'm currently within the working or home directory
of the student, which is /home/student.
And if I list out the contents of this directory,
we have two binaries here.
We have a binary called greetings
and we have a binary called welcome.
Now welcome, as we can see here, is owned by the root user,
and we can actually execute this particular binary,
as you can see.
Every user, every other user account and group on the system
can execute this binary.
However, if we take or pay close attention to this s permission
here, that is the SUID permission.
So if you take a look at the other binaries here,
they don't have the s permission applied here, which as I said,
implies that the SUID permission has been applied
to this particular binary, which means it is executed with root
privileges.
So let's try and execute the greetings binary.
So we'll say greetings, although we actually cannot execute it.
So I'm just going to say greetings.
And of course, we are told permission denied.
If we try and execute the welcome directory,
or the welcome binary for that matter,
it'll tell us "Welcome to Attack Defense Labs."
So again, this binary will just set up
to demonstrate this vulnerability.
What we can do now is learn more about
this particular welcome binary.
And the way we can do that is, of course,
by utilizing the type or file command.
So again, we can essentially just say, for example,
here we can just say file and welcome,
and it'll tell us that this is a standard ELF binary for Linux.
And again, it tells you--
it gives you an idea as to what shared objects are being loaded
by this particular binary.
That is also another alternative when it comes down
to exploiting SUID binaries.
If you can somehow find missing shared objects,
you can essentially create your own shared object
and get this binary to load it.
And of course, that shared object
is going to be malicious in nature,
or it is going to execute malicious commands that
will elevate your session.
But in this case, this particular binary
doesn't have any missing shared objects.
So let's try and identify what strings
we can find within this binary.
So the strings command will essentially
give us a list of strings within the binary.
So this is just basic static analysis.
So I'll type in strings welcome.
And let's start off from the beginning.
So you can see it actually loads or calls
upon the shared object here and another one right over there.
And you can see the setuid permission.
And let's take a look at some of the other options here.
And if we take a look at this here,
we can see that it calls upon the greetings binary, which is
very, very interesting, right?
So it's calling upon an external binary, which is, as I said,
very interesting.
So what if we create or modify the greetings binary
and we have it execute a command like bash
or we have it execute the bash binary.
And of course, because this particular welcome binary
is being executed with root privileges
because it is an SUID binary, then it
will execute the commands or--
it will actually execute the command specified
within the greetings binary.
So let's actually clear out the terminal.
And we can actually get rid of the current greetings
binary here.
And I'm just going to hit Yes.
And what we can do is we can essentially just say--
or we can create our own greetings binary quite
simply by saying--
we can copy bin/bash, so essentially just
creating a copy of bash, and we're
going to save it as greetings.
So this is essentially a bash binary,
but it's called greetings.
Now because the welcome binary calls
upon the greetings binary, it'll execute bash
with root privileges, which will consequently
provide us with a root bash session
with elevated privileges.
So we can actually test this out.
So if I say welcome-- if I run the welcome binary again,
you can see that it's going to execute
the greetings binary, which is, in essence, just a bash binary.
And we immediately obtain root privileges.
And if I say ID, you can see where currently we currently
have access as the root user.
And of course I can confirm that there.
And if I try and execute or run commands
that require root privileges, like the ability
to view the shadow file, you can see
I can list out the contents of the shadow file right
over here.
And we have successfully been able to elevate our privileges
through the use of an SUID binary.
Now as I said, there's multiple misconfigurations
that you can look for.
As I said, one of them is to obtain
missing shared objects that are being called upon by the SUID
binary and creating your own shared object.
And again, once the binary is executed,
it will then find the shared object
that it couldn't find before and it will execute that shared
object with the malicious comments that you
have that you've actually entered within the shared
object file, consequently providing you
with elevated privileges.
So that's really as simple as it gets in regards
to exploiting SUID binaries.
This is by no means a comprehensive view
or look at SUID binaries and how they can be exploited.
I will definitely be exploring all the various SUID binary
exploitation techniques in the privileged escalation course.
All right, so this is going to conclude-- or rather,
this is the conclusion to the practical demonstration
side of this video.
All right, so that is going to conclude
the Linux privileged escalation section of this course.
We're now moving on to the final section of this course, which
will essentially entail the process of dumping credentials
and hashes from Linux systems.
So I'll see you there.