This is a massive subject, so I will stick to giving a few key pointers, and leave further study up to the reader.
Please remember to use these techniques only for legitimate educational and testing purposes and not maliciously.
Having learned about and performed a lot of privilege escalation over recent months, there are several reasons I can think of that can make this especially difficult on Linux.
1) Linux has always been designed as a multi-user operating system, which means that many features have been included over the years, to make privilege escalation more difficult (as well as secure default-configurations).
2) There is a huge diversity of Linux distributions, and builds, so there are no "one size fits all" exes that you can just download and run.
3) Many Linux Distributions have integrated application-updates (something which does not happen on Windows). This means that (if configured correctly) the operating system AND most of the applications will get updates automatically.
4) Many Offsec students are from a Windows background, where privilege escalation is often not needed. This is either because ordinary user accounts are in the local Administrator group, or because there are many Windows remote-exploits which give direct System or Administrator access and do not require escalation.
5) Linux configuration issues can sometimes be hard to spot, especially if you are not very familiar with Linux file-rights and access-control methods.
So, if you are learning how to perform privilege escalation on linux, you should expect it to be more difficult than Windows.
Linux privilege escalation is difficult, it's supposed to be, but practice can make it easier.
Enumeration is key
Linux privilege escalation is all about:
1) Enumeration, more enumeration, and more enumeration
2) Sorting through data, analysis and prioritisation
3) Knowing where to find exploit code
4) Customisation and compilation skills
5) Confidence that comes from lots of trial and error
Ideas; What information do you need to find?
Here is a list of some of the information an attacker would be looking to find in order to maximise their chances of successful privilege escalation on Linux.
(It's not comprehensive, but it is a good start)
Enumeration of the operating system
- What is the distribution type, and version?
- What is the Kernel version?
Enumeration of services and applications
- What services are running, and in which user-context?
- What are the versions of the running services?
- What applications are installed, and what versions?
- Do any of these services have vulnerable plugins or configurations.
- What jobs are scheduled?
- Pay particular attention to anything running as root
Enumeration of the file-systems
- What configuration files can be read/written in /etc/ ?
- What information or content can be found in /var/ ?
- Is it possible to write files to places that are in another users path?
- Identify SUID and GUID files
- Identify world-readable and world-writable files
- How are file-systems mounted?
- Are there any unmounted file-systems?
Enumeration of confidential information
- What sensitive files can be found?
- Are there any passwords in; scripts, databases, configuration files or log files?
- What user information can be found?
- Can private-key information be found?
- Examine files in user home directories (if possible)
Enumeration of communications and networking
- What NICs does the system have?
- What are the network configuration settings?
- What other hosts are communicating with the system?
- Are there any cached IP or MAC addresses?
- Is packet sniffing possible, and if so what can be seen?
- Is SSH tunnelling possible?
Preparation for exploit code
- What development tools/languages are installed/supported?
- What areas can be written to?
- Where can code be executed?
- How can files be uploaded?
Finding exploit code
The only way to learn how to do privilege escalation is to practice, and keep trying.
Be good!
Mitigations
From a defensive stance, you need to ask yourself very similar questions
- Have you made any of the above information easy for an attacker to find?
- Is the system fully patched? (Kernel, operating system, and all applications)
- Are services running with the minimum level of privileges required?
- Bastille Linux is a set of scripts that can be run to harden a Linux system
- (checking for some of the above issues, and many more besides)
