Skip to main content

2019 | OriginalPaper | Buchkapitel

9. Privilege Escalation in Linux

verfasst von : Mike O’Leary

Erschienen in: Cyber Operations

Verlag: Apress

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

An attacker that gains a foothold on a Linux system wants to escalate privileges to root in the same way that an attacker on a Windows domain wants to escalate privileges to Administrator or Domain Administrator. The techniques used on a Linux target are somewhat different. There are fewer privilege escalation modules in Metasploit, so an attacker may need to rely on a customized exploit. The success of these exploits may require a particular distribution and a version. These exploits are usually distributed as source code, and so need to be compiled. The 2016 Dirty COW class of attacks is particularly powerful because they work against such a wide range of systems; nearly every Linux system prior to the 2016 patch can be exploited.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Fußnoten
1
When practicing these exploits, it is helpful if you keep an original copy of the file /etc/passwd and a shell running as the root user open. Most distributions have as their first entry in /etc/passwd the entry for the root user - this is the line that gets munched during the exploit. If the root user is gone, and you don’t have a root shell or a copy of /etc/passwd, well, you are having an exciting day.
 
2
This approach can work even if SELinux is running on the target.
 
3
Although the shell is more stable, it still may result in a system crash.
 
4
This is loosely based on the backup script from https://help.ubuntu.com/lts/serverguide/backup-shellscripts.html that is used to illustrate cron jobs, and has been modified to make it less secure.
 
5
Suppose an administrator has dozens of Linux virtual machines running on VirtualBox for testing security techniques. This script backs up the Desktop on these systems to a VirtualBox shared folder that could be could be read without the hassle of starting each virtual machine.
 
6
The command to make this change is sudo chmod u+s /usr/bin/nmap.
 
7
The wordlist /usr/share/wordlists/metasploit/password.lst does not contain the password selected for these systems (password1!), so it has been added to this file.
 
8
The fact that this web page is not considered trusted by Chrome is probably just another metaphor.
 
Metadaten
Titel
Privilege Escalation in Linux
verfasst von
Mike O’Leary
Copyright-Jahr
2019
Verlag
Apress
DOI
https://doi.org/10.1007/978-1-4842-4294-0_9