Howlsec
HOWLSEC
offensive security
// notes/ PrivEsc — Linux
🐧

Suid Vulnversity

Notes from oscp.adot8.com — linux privilege escalation.

#linux privilege escalation#adot8
source · oscp.adot8.com · linux-privilege-escalation/suid_vulnversity ↗

Vulnversity

code
01  ___                        
02 ( _ ) _ __ ___   __ _ _ __  
03 / _ \| '_ ` _ \ / _` | '_ \ 
04| (_) | | | | | | (_| | |_) |
05 \___/|_| |_| |_|\__,_| .__/ 
06                      |_|    
07 
08[+] Scanning 10.10.137.87 [65535 ports]
09 
10 
11[+] Enumerating 10.10.137.87 [21,22,139,445,3128,3333]
12 
13Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-03 06:08 CDT
14Nmap scan report for 10.10.137.87
15Host is up (0.13s latency).
16 
17PORT     STATE SERVICE     VERSION
1821/tcp   open  ftp         vsftpd 3.0.3
1922/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.7 (Ubuntu Linux; protocol 2.0)
20| ssh-hostkey: 
21|   2048 5a:4f:fc:b8:c8:76:1c:b5:85:1c:ac:b2:86:41:1c:5a (RSA)
22|   256 ac:9d:ec:44:61:0c:28:85:00:88:e9:68:e9:d0:cb:3d (ECDSA)
23|_  256 30:50:cb:70:5a:86:57:22:cb:52:d9:36:34:dc:a5:58 (ED25519)
24139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
25445/tcp  open  netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
263128/tcp open  http-proxy  Squid http proxy 3.5.12
27|_http-server-header: squid/3.5.12
28|_http-title: ERROR: The requested URL could not be retrieved
293333/tcp open  http        Apache httpd 2.4.18 ((Ubuntu))
30|_http-server-header: Apache/2.4.18 (Ubuntu)
31|_http-title: Vuln University
32Service Info: Host: VULNUNIVERSITY; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
33 
34Host script results:
35| smb2-time: 
36|   date: 2024-05-03T11:08:53
37|_  start_date: N/A
38|_clock-skew: mean: 1h20m00s, deviation: 2h18m34s, median: 0s
39| smb-security-mode: 
40|   account_used: guest
41|   authentication_level: user
42|   challenge_response: supported
43|_  message_signing: disabled (dangerous, but default)
44|_nbstat: NetBIOS name: VULNUNIVERSITY, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
45| smb-os-discovery: 
46|   OS: Windows 6.1 (Samba 4.3.11-Ubuntu)
47|   Computer name: vulnuniversity
48|   NetBIOS computer name: VULNUNIVERSITY\x00
49|   Domain name: \x00
50|   FQDN: vulnuniversity
51|_  System time: 2024-05-03T07:08:53-04:00
52| smb2-security-mode: 
53|   3:1:1: 
54|_    Message signing enabled but not required
55 
56Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
57Nmap done: 1 IP address (1 host up) scanned in 28.46 seconds
58 
59[+] Enumerating 10.10.137.87 for vulnerabilities [21,22,139,445,3128,3333]
60 
61Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-03 06:08 CDT
62Pre-scan script results:
63|_broadcast-avahi-dos: ERROR: Script execution failed (use -d to debug)
64Nmap scan report for 10.10.137.87
65Host is up (0.13s latency).
66 
67PORT     STATE SERVICE
6821/tcp   open  ftp
6922/tcp   open  ssh
70139/tcp  open  netbios-ssn
71445/tcp  open  microsoft-ds
723128/tcp open  squid-http
733333/tcp open  dec-notes
74 
75Host script results:
76| smb-vuln-regsvc-dos: 
77|   VULNERABLE:
78|   Service regsvc in Microsoft Windows systems vulnerable to denial of service
79|     State: VULNERABLE
80|       The service regsvc in Microsoft Windows 2000 systems is vulnerable to denial of service caused by a null deference
81|       pointer. This script will crash the service if it is vulnerable. This vulnerability was discovered by Ron Bowes
82|       while working on smb-enum-sessions.
83|_          
84|_smb-vuln-ms10-061: false
85|_smb-vuln-ms10-054: false
86 
87Nmap done: 1 IP address (1 host up) scanned in 40.69 seconds
88 
89[+] Completed!
<figure><img src="/files/xA0Y9gXV3rUnHdW4vyi7" alt=""><figcaption></figcaption></figure>
code
01 
02        /'___\  /'___\           /'___\       
03       /\ \__/ /\ \__/  __  __  /\ \__/       
04       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
05        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
06         \ \_\   \ \_\  \ \____/  \ \_\       
07          \/_/    \/_/   \/___/    \/_/       
08 
09       v2.1.0-dev
10________________________________________________
11 
12 :: Method           : GET
13 :: URL              : http://10.10.137.87:3333/FUZZ
14 :: Wordlist         : FUZZ: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
15 :: Follow redirects : false
16 :: Calibration      : false
17 :: Timeout          : 10
18 :: Threads          : 40
19 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
20________________________________________________
21 
22# Attribution-Share Alike 3.0 License. To view a copy of this  [Status: 200, Size: 33014, Words: 8161, Lines: 653, Duration: 133ms]
23# Suite 300, San Francisco, California, 94105, USA. [Status: 200, Size: 33014, Words: 8161, Lines: 653, Duration: 137ms]
24# Copyright 2007 James Fisher [Status: 200, Size: 33014, Words: 8161, Lines: 653, Duration: 137ms]
25#                       [Status: 200, Size: 33014, Words: 8161, Lines: 653, Duration: 138ms]
26#                       [Status: 200, Size: 33014, Words: 8161, Lines: 653, Duration: 138ms]
27# or send a letter to Creative Commons, 171 Second Street,  [Status: 200, Size: 33014, Words: 8161, Lines: 653, Duration: 139ms]
28# Priority ordered case sensative list, where entries were found  [Status: 200, Size: 33014, Words: 8161, Lines: 653, Duration: 144ms]
29#                       [Status: 200, Size: 33014, Words: 8161, Lines: 653, Duration: 144ms]
30# license, visit http://creativecommons.org/licenses/by-sa/3.0/  [Status: 200, Size: 33014, Words: 8161, Lines: 653, Duration: 144ms]
31# on atleast 2 different hosts [Status: 200, Size: 33014, Words: 8161, Lines: 653, Duration: 144ms]
32# directory-list-2.3-medium.txt [Status: 200, Size: 33014, Words: 8161, Lines: 653, Duration: 619ms]
33images                  [Status: 301, Size: 320, Words: 20, Lines: 10, Duration: 1618ms]
34                        [Status: 200, Size: 33014, Words: 8161, Lines: 653, Duration: 1618ms]
35#                       [Status: 200, Size: 33014, Words: 8161, Lines: 653, Duration: 2623ms]
36# This work is licensed under the Creative Commons  [Status: 200, Size: 33014, Words: 8161, Lines: 653, Duration: 4635ms]
37css                     [Status: 301, Size: 317, Words: 20, Lines: 10, Duration: 127ms]
38js                      [Status: 301, Size: 316, Words: 20, Lines: 10, Duration: 123ms]
39fonts                   [Status: 301, Size: 319, Words: 20, Lines: 10, Duration: 131ms]
40internal                [Status: 301, Size: 322, Words: 20, Lines: 10, Duration: 130ms]
41                        [Status: 200, Size: 33014, Words: 8161, Lines: 653, Duration: 154ms]
42server-status           [Status: 403, Size: 302, Words: 22, Lines: 12, Duration: 128ms]
43:: Progress: [220560/220560] :: Job [1/1] :: 315 req/sec :: Duration: [0:12:39] :: Errors: 0 ::
44
<figure><img src="/files/ThoQCXizDVv4bUSb8yld" alt=""><figcaption></figcaption></figure> <figure><img src="/files/UegJMvkPBIH1XxXAmWKy" alt=""><figcaption></figcaption></figure>
code
01        /'___\  /'___\           /'___\       
02       /\ \__/ /\ \__/  __  __  /\ \__/       
03       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
04        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
05         \ \_\   \ \_\  \ \____/  \ \_\       
06          \/_/    \/_/   \/___/    \/_/       
07 
08       v2.1.0-dev
09________________________________________________
10 
11 :: Method           : GET
12 :: URL              : http://10.10.100.43:3333/internal/FUZZ
13 :: Wordlist         : FUZZ: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
14 :: Follow redirects : false
15 :: Calibration      : false
16 :: Timeout          : 10
17 :: Threads          : 40
18 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
19________________________________________________
20 
21# or send a letter to Creative Commons, 171 Second Street,  [Status: 200, Size: 525, Words: 62, Lines: 27, Duration: 136ms]
22# Suite 300, San Francisco, California, 94105, USA. [Status: 200, Size: 525, Words: 62, Lines: 27, Duration: 136ms]
23# This work is licensed under the Creative Commons  [Status: 200, Size: 525, Words: 62, Lines: 27, Duration: 152ms]
24# Attribution-Share Alike 3.0 License. To view a copy of this  [Status: 200, Size: 525, Words: 62, Lines: 27, Duration: 152ms]
25# license, visit http://creativecommons.org/licenses/by-sa/3.0/  [Status: 200, Size: 525, Words: 62, Lines: 27, Duration: 153ms]
26#                       [Status: 200, Size: 525, Words: 62, Lines: 27, Duration: 309ms]
27uploads                 [Status: 301, Size: 330, Words: 20, Lines: 10, Duration: 133ms]
28# Copyright 2007 James Fisher [Status: 200, Size: 525, Words: 62, Lines: 27, Duration: 2320ms]
29# on atleast 2 different hosts [Status: 200, Size: 525, Words: 62, Lines: 27, Duration: 2322ms]
30#                       [Status: 200, Size: 525, Words: 62, Lines: 27, Duration: 2322ms]
31                        [Status: 200, Size: 525, Words: 62, Lines: 27, Duration: 3312ms]
32# directory-list-2.3-medium.txt [Status: 200, Size: 525, Words: 62, Lines: 27, Duration: 3357ms]
33# Priority ordered case sensative list, where entries were found  [Status: 200, Size: 525, Words: 62, Lines: 27, Duration: 3393ms]
34css                     [Status: 301, Size: 326, Words: 20, Lines: 10, Duration: 129ms]
35#                       [Status: 200, Size: 525, Words: 62, Lines: 27, Duration: 5323ms]
36#                       [Status: 200, Size: 525, Words: 62, Lines: 27, Duration: 5323ms]
37
<figure><img src="/files/5O1JeVlWpymRPsJGIhVs" alt=""><figcaption></figcaption></figure> <figure><img src="/files/v3pn1QyoWNb0Rrfd89UM" alt=""><figcaption></figcaption></figure>

{% embed url="https://gtfobins.github.io/gtfobins/systemctl/" %}

<figure><img src="/files/LWlwiK0do6Vvf7UqgWKb" alt=""><figcaption></figcaption></figure>