Linux Privilege Escalation (Part 1 of 3)

 

Introduction

Viewing, editing, or modifying system files are common privileges. Privilege escalation happens when a user receives privileges they are not entitled to. Hence, they can easily delete files, view private information, or install viruses through these privileges. It is an act of exploiting a bug, design flaw, or configuration oversight in an operating system or software application to gain elevated access to resources that an application of user normally protects.

Linux Privilege Escalation

The penetration tester often acquires initial footing on a system as a non-privileged user and then obtain further access permissions. It is a necessary skill because "direct-to-root" compromises are very rare in modern environments. There are several common escalation techniques that can exploit misconfigured services, direct kernel vulnerabilities, sensitive data stored in local files, and whatnot.

Manual Enumeration

After successfully compromising a target and establishing as an unprivileged user, penetration tester go for enumeration and analyzation of the system to gain more information about that target. Enumerating a system manually might take a long time. However, this method can also provide greater control and may disclose even more privilege escalation techniques overlooked by the automated tools. The most likely steps to this enumeration process are-

1. User enumeration
2. Hostname enumeration
3. Operating System Version and Architecture enumeration
4. Running Processes and Services enumeration
5. Networking Information enumeration
6. Firewall Status and Rules enumeration
7. Scheduled Tasks enumeration
8. Installed Applications and Patch Levels enumeration
9. Readable/Writeable Files and Directories enumeration
10. Unmounted Disks enumeration
11. Device Drivers and Kernel Modules enumeration
12. Binaries That AutoElevate enumeration

Firstly, after gaining the initial access, the penetration tester will enumerate the users and identify the user context. The commands that can be used to reveal the information about the system's users are whoami, id, uname, -a, cat/etc/passwd. 

Automated Enumeration

Each operating system consists of a plethora of data that may be exploited to launch additional assaults. Thus, manually compiling everything may be very much time-consuming. However, this procedure can be automated via a variety of scripts. Some of the scripts that can do this process on Windows are WinPeas and windows-privesc-check, and Linux OS are LinPeas and unix-privesc-check.

Conclusion

This is an introductory part for Linux Privilege Escalation and more will be discussed in the next part.