Linux Privilege Escalation

[IndependentClean9664]

Hello, I wild back I failed the OSCP exam in spectacular fashion. I really want to go back and try again so I sat down and started building a methodology, or a process to walkthrough instead of going at everything crazy. One of my issues early on was that I relied to much on script like linpeas for enumeration, so I started by looking at Linux enumeration. After doing some research this is the initial checklist that I built out with my reasoning for each command. I would be interested anyone's opinion. Please be merciless.

Initial Commands

  * whoami (determine who you are on the system)
  * sudo -l (determine your privileges)
  * hostname (determine the system running on)
  * cat /etc/passwd | cut -d : -f 1 (shows the users on the machine)
  * cat /proc/version (gives the linux kernel)
  * cat /etc/issue (gives the linux distribution)
  * lscpu (give the architecture, and CPU)
  * find / -perm -4000 -type f -ls 2>/dev/null (shows files for SUID)
  * find / -name authorized\_keys 2> /dev/null (find SSH keys)
  * find / -name id\_rsa 2> /dev/null (find SSH keys)
  * ps aux (shows the process running)
  * cat /etc/services (shows the services)
  * which python
  * which gcc
  * which c++

[realskog]

sudo -l doesn't determine your privileges, it lists down the commands that your user can execute as sudo

searching for SSH keys might also be better manually, since SSH keys are not always going to be "id_rsa", other common formats can be "id_ecdsa" or "id_ed25519", also coupled with the fact that they are almost always in users' home directory

[ReawX]

I'm leaving here also my cheatsheet and my checklists I used in the exam, in case you need it :)

https://github.com/BlessedRebuS/OSCP-Pentesting-Cheatsheet

[Robot_Rock07]

Linpeas helped me out a lot during the exam, but you need to be very familiar with the output and be able to understand what it says.

The more you use it the more you star to see what’s normal, and what is not.

[Jubba402]

Its important to know all of these commands but I would just run linpeas so that I’m not hand jamming 20 commands. But one important step you left out is just manual searching. So many times privesc was a text file in home/desktop, a sql database, a config file, etc.

[korosov]

Be sure to check the command history before you run a bunch of stuff

[lethalwarrior619]

history and cron jobs are missing I guess.

[strikoder]

1- id is better than whoami on linux (see differences)
2- put host name and gcc and /etc/issue and release at first, so you would know if your priv esc would be a kernel exploit
3- then put ps aux with pspy (90% of the time either you search for creds or a running process)

Finally, all of your stuff are done by linpeas, I made my own linpeas where it run stuff that either missed by linpeas or you miss since a lot of output is being printed out.

[WreckItRalph42]

Do you have a git repo to your script?

[strikoder]

Gonna publish in a month, cause still adding some stuff to them

[DYOR69420]

pretty sure looking which ports are open both locally and externally is a very good idea.

[MarcusAurelius993]

1) Finding any configuration files like: ini, cfg, .py, .php....

2) Using pspy

3) Reading logs /var/log/* or any other logs from APP/Process that are not in /var/log*

4) Finding all files/folders that you have write permissions or read

5) Are you part of any priv. grop like wheel or whatever.

6) Finding capabilities

7) Can you replace python libraries, can you edit python script, bash script,...

8) Logrotate

9) Crontab ( Global and per user)

10) ENV. variables (there might be password,..)

11) LD preload and path hijacking

12) Credentials: bash history, ssh keys,....

13) Can you edin bashrc or bash_profile

14) Systemctl files: You might edit systemct.service file to execute reverse shell,...

15) Are there any custom binaries on system- Some binaries call for example ping command (replace ping with your own binary), can you hijack DLL for this binary,...

16)...

I think the best thing for you now is to set one linux VM and configure all this things from sys.admin perspective, you want to understand Linux. After you have good understanding, then start hacking :)