[THEME TUNE PLAYING]
Linux Privilege Escalation, Exploiting A Vulnerable
Program.
In this video, we will be exploring
the process of elevating our privileges on a Linux system
through the use of the Metasploit framework.
And in specific, we will be taking a look
at a technique that involves exploiting a vulnerable program
installed on the Linux target in order
to elevate our privileges.
Now when we talk about privilege escalation on both Windows
and Linux, there are various privilege escalation techniques
that can be utilized in order to elevate your privileges.
And of course, given the fact that this is a Metasploit
course, we are primarily going to be focusing
on the techniques that can be performed using the Metasploit
framework.
So in this case, the technique that we will be exploring
is the process of exploiting a vulnerable program on the Linux
target system that, again, can provide us
with elevated privileges.
Now the privilege escalation techniques that we can utilize
will depend on the version of the Linux kernel
running on the target system as well as the distribution
release version.
So again, when it comes down to Linux,
and in specific, kernel exploitation, which, again,
is very common, the most important piece of information
is going to be the actual kernel version as well
as the distribution release version.
So given that that is the case, the Metasploit framework
offers very little in regards to Linux kernel exploit modules.
However, in some cases, there may be an exploit module
that can be utilized to exploit a vulnerable service
or program in order to elevate our privileges.
So the technique here really involves
performing local privilege escalation
through the exploitation of a vulnerable program.
Now of course, the process of enumerating or finding out
what program on the Linux target is vulnerable to a privilege
escalation exploit or vulnerability
can be done manually.
And in this case, that's exactly what
we're going to be exploring.
So again, all you need to do is just start up
your lab environment and I'll join you in,
and we can take a look at how we can elevate our privileges
on a Linux system.
All right.
So I'm back within the lab environment.
And the first step, of course, is to identify the target IP
address.
So we type in ifconfig and head over to the interface Ethernet
1.
The target IP address is going to be in the same subnet here.
Of course, it's going to be the next IP within the subnet.
So in your case, this subnet will be different.
The only thing that you need to do
is just copy this particular IP and change the value 2 to a 3,
and that's the target IP.
Right?
So we'll copy that.
I'm then going to start up the PostgreSQL database service.
I'm going to say service PostgreSQL Start and MSF
console.
And that will start both at the PostgreSQL database server
as well as the MSF console.
All right.
So there we are.
As you can see, that started both.
And we can then create a workspace, and in this case,
we're just going to call it a Linux PrivEsc.
We'll just call it Linux PrivEsc.
There we are.
Fantastic.
We are then going to set up the global variable for the RHost
option.
And we're going to specify the target IP as the value here.
And of course, that will save us from having
to type in the target IP address whenever we load a module.
So I'll hit Enter.
And of course, remember to change the 2 to a 3.
Fantastic.
OK.
So now that that is done, we can actually
begin the process of gaining access to the target system.
Now in this case, the documentation for this lab
already provides you with the SSH credentials
as that is going to be our access vector.
So again, just to confirm, we can perform a quick Nmap scan
using the DB_Nmap command.
And of course, that will allow us to perform the Nmap
scan from within MSF console and furthermore,
it will save the Nmap scan results
into the Metasploit framework database
within our current workspace.
So we'll perform some service version detection,
and I'll paste in the target IP.
Remember to change the 2 to a 3.
And it Enter.
As you can see, we have port 22 open on the target system
and that's running SSH.
So again, as per the documentation
provided within this lab, we already
have the SSH credentials.
So we actually do not need to get into the process
of performing a brute force.
So in order to log in using the credentials,
we will say Search, and we will utilize the SSH log
in module which we have utilized previously during the SSH
enumeration section.
There we are.
And we're going to use the first module here.
And we're going to say Use, based that in there.
And if we show the options here, the only value
that we need to specify is going to be
the password and the username.
Now as per the credentials provided within the lab
documentation, the username that we can log in with is "Jackie."
All right.
And the password is going to be "password."
Right?
So it's a fairly simple password there.
And of course, we have the target IP specified,
because we set up the global variable for the RHost option
as well as the RPort option, which is set to 22.
So I'll hit Enter.
And then I can Exploit.
And this will authenticate and provide us
with a command shell session on the target system.
So it says Success Jackie and password.
And then it opens up a command shell session there.
So if I say Sessions, you can see that we
have a command shell session.
And if we say Sessions 1, and you can see that
gives us access to the Linux terminal
or to the Linux system via a command shell.
So if I say PWD, you can see we are within the Jackie home
directory.
So I'll open up a bash session here.
And I'll use bin/bash I. Fantastic.
As you can see, we are currently logged in as the user Jackie.
So again, we can perform some basic enumeration
like who am I. We can see that we are indeed Jackie.
If we say cat etc issue, that's the distribution release
version.
So it's Ubuntu 18.04.3 LTS.
We can say Uname R, and we get the kernel version.
Right?
However in this case, what we want to do
is we want to essentially establish a Meterpreter session
or to upgrade our command shell session into a Meterpreter
session, which is fairly simple to do.
So I'll put this in the background.
And we will then utilize the Sessions command
and say we want to upgrade session 1.
So I'm going to say Sessions, Upgrade 1.
Hit Enter.
Don't worry if it gives you the error
here telling you that this session may not
be compatible with this module.
So it's going to say Upgrading Session 1.
We'll just give that a couple of seconds to complete.
All right.
So it starts up the exploit multi handler
and starts the reverse DCP handler on port 4433.
All right.
And don't worry if it gives you this error right over here.
If we say Sessions, you can see that we have a Meterpreter
session and that is session 2.
Right?
So you can say Sessions 2, and again,
SysInfo, Get User ID, et cetera, et cetera.
Right?
And in this case, it says No User
but it provides us with the user ID.
And in this case, we know that the user is Jackie.
And of course, if we say Shell, and then open up
a bash session here, we can enumerate the users
on the system by saying cat etc password.
As we can see, we only have two user accounts.
One of them is Jackie, and the other one
is the root user account.
So the rest of them are all service accounts,
and we want to elevate our privileges
to that of the root user.
OK.
So what we can do now in order to identify
the vulnerable program or service,
we can essentially list out the processes
running on the system using the command ps aux.
And if we take a look at the process tree,
we can see that the user root here
has initiated a program binary or script
and has executed it with bash, and the name of the binary
or script is called Check Down, and it's
stored within the binary directory
here or the binaries directory.
So we can actually check out what
this file does by cutting the contents of the file.
And of course, it could be a binary or it could be a script.
And in this case, it looks like it is a Bash script.
Right?
So within the bash script, we can see some logic or some code
here.
So this is a while loop, whereby the binary CHK
rootkit is executed every 60 seconds or every minute.
Right?
So this particular check down script
is used to run CHK rootkit every 60 seconds.
OK?
So what is CHK rootkit?
Well CHK rootkit is a Linux utility
that is used to scan a Linux system for rootkit.
So it's an anti rootkit system.
Now CHK rootkit in this particular case
is vulnerable to a local privilege escalation
vulnerability, but it only affects
versions older than 0.5.0.
So we can check out the version of CHK rootkit
by saying CHK rootkit, and if we say Help,
we can see that we can enumerate the version by using
the hyphen uppercase V option.
So I'm going to say CHK rootkit hyphen V. And as you can see,
the version of CHK rootkit is 0.4.9,
which means we can exploit this particular binary in order
to elevate our privileges.
Now in order to do this, what we're going to need to do
is, of course, put this in the background.
So I'm going to terminate this channel
and I'll put the Meterpreter session in the background.
And we can search for the CHK rootkit exploit module here.
So I'm going to say search CHK rootkit.
And this is the exploit module here.
As you can see, this is CHK rootkit local privilege
escalation.
And in terms of usability, we need to configure it manually.
All right.
So it's fairly simple to configure.
And we can say Use.
Paste that in there.
If we show the Options, you can see we have the ability
to specify the session, and we can also
configure the payload option, which
in this case, the payload that's being used
is a simple command shell payload for Unix.
If we type in Info, we can see that it tells us CHK rootkit
before 0.5.0 or 0.50 will run any executable file named temp
update as root allowing a trivial privilege escalation.
Right?
So what we can do is we can specify the actual path to CHK
rootkit, first and foremost, and we can also specify the session
to run this module on.
Now when we perform the enumeration of CHK rootkit,
we see that CHK rootkit is stored
under the binary directory.
So Binary CHK Rootkit.
So in order to execute this, what we can do
is say or set the CHK rootkit option.
Here we are.
And we'll just set this to User or just
under Binary CHK Rootkit.
Right?
Because Linux will be able to specify that
or to identify the actual value of the binary.
So what we'll do is we will set that to Bin CHK rootkit.
There we are.
And we'll set the session to session 2,
because we want to run this via the Meterpreter session.
We then need to set the LHost option
to the value of Ethernet 1.
So I'm going to type in ifconfig,
and we'll just copy the ethernet 1 IP address here.
So I'm going to say Set LHost.
And there we are.
And we can leave LPort as is.
It probably-- If we say Show Options,
we can see that it doesn't display the actual LPort
options.
However, if we say Sessions here,
we can see that the ports being used are port 4433 and 38717.
So again, in this case, that is fine.
We can just hit Exploit.
And we'll hit Enter.
And it's going to say Started the reverse TCP double handler.
It's then going to tell you that routing
will depend on the crontab.
So it'll actually create a Cron job to execute the temp update
file that has been created, and of course, it's
then going to wait for CHK rootkit to run via Cron.
So again, I'm just going to give this a few seconds.
And in this case, it looks like it's utilizing the LHost IP
and it's said the interface being set
there is actually Ethernet 0.
So let's actually change this up here.
So if we show the options now, we
can see that LHost has been set to the IP address of Ethernet
0.
So if we say ifconfig, we can set that to the IP address
on Ethernet 1.
So I'm going to say Set LHost to the IP there.
And we can then Exploit.
All right.
So it's going to wait for CHK rootkit to run via Cron.
We're going to give that a few seconds.
Now we may have to change the actual path to CHK rootkit
if this doesn't work.
So we may have to specify the absolute path.
But we're just going to wait for CHK rootkit
to run via Cron as it's going to be executed via the Cron job.
So we'll give this a few seconds.
Again, if it doesn't start up in a few seconds,
we may need to change the actual path to CHK rootkit.
All right.
So after a few seconds, we can see that it actually accepts
the first client connection, the second client connection,
and then writes to socket A and socket B,
and we get a command shell session open.
So if we say bin/bash I, you can see that we now
have root access and have successfully been
able to elevate our privileges.
So if I say Who am I, you can see we are root
and we now have root privileges.
So that is how to elevate your privileges on a Linux system
through or via exploiting a vulnerable program or binary
that's on the Linux system.
And of course, this is also applicable to a kernel exploit.
However, kernel exploits in the case of the Metasploit
framework will need to be done manually
and will involve the process of downloading
exploit code remotely.
So that is going to conclude the practical demonstration
side of this video.
In the next video, we will be exploring
the process of dumping hashes on a Linux system
through the use of the hash dump module.
All right.
So I'll see you in the next video.