Linux Hackers Become Root with CURL & Sudo

Key Takeaways

I created a capture the flag challenge called curly fries this was a miscellaneous task in the ncon capture the flag 20124 the fifth time we've hosted that game a ton of fun and this is a privilege escalation challenge with a special thanks to tiberious who gave me the inspiration for this after he had kind of an interesting solution for the end of bookstore which is another challenge I created for hacking Hub I can add a link in the description if you're interested in that but looks like all we need to do is escalate our Privileges and run the program in the root users home directory now this required an SSH connection I am running this locally because we have now turn down the infrastructure for the ncon capula flag I will try to get the challenges up and available for you in another location but in this case I will go ahead and SSH into my Local Host just hosting the challenge for us to work with the prompt included the credentials user being the username and user pass as the password now if we were to LS inside of this directory I am just user at curly fries as the host but there's nothing really here there's not a whole lot to go off of however it is a privilege escalation challenge which might clue Us in that we could use pseudo super user do he try to run things as the root user we could use Tac L to list what commands we might be able to do now our user may do the following looks like we could run as the user fry Hey that entity that identity that we wanted to at least try to gain access to before we got to the root user and without a password we could run the curl command that utility to access a lot of web URLs right hey actually access the internet make HTTP requests but this seems like we could only request something on Local Host so 1271 as the IP address on Port 8000 and only going to a health check so before we even run this with pseudo we could just straight up curl look do we even have anything running on Port 8 000 uh no in this case I think we might be able to use SS or netstat uh we don't have any of those installed oh okay I guess we have netstat because we're in an Alpine Docker container but at the very least we don't have a host actually being served anything actually accessible on Port 8000 because I intended you to just spin up your own HTTP server on Port 8000 so we could simply just run I believe we have Python 3 in this case yes we do so Python 3 which me we could use Tac M to specify a module that we want to run and it does have the built-in HTTP module do server will allow us to Simply host a HTTP server on Port 8000 by default that keeps it easy with that we could then access that on Port 8000 problem is and actually I will need to create another terminal if I were to do this so I'm going to drop down with Terminator just to get another shell once again enter the password and now I could curl http P if you wanted to include the schema I believe it'll add it by default my microphone is in the way and I can't even read my keyboard because I do occasionally look at the keyboard to see where the number seven is now that's not all that helpful we get a directory listing that's just the default natural hey functionality of a HTTP do server hosted with python however we could run with the pseudo tacl reference anything going to/ health check so if we were to create a file we could just simply uh you know what we should actually host probably out of the temporary directory maybe that's fine for us we can make a directory for like dub dub dub and that way we can run the exact same Python 3 HTTP server in that location let me get back over there in the other shell so I could just do a Please Subscribe with typos and everything in that health check file now I could end up running curl http1 12781 48,000 for the health check file curling that down we get our please suby okay but again that's not all that helpful to us we could do a little bit more enumeration and see what else is on the box knowing that at the very least from the pseudo output without having any other reconnaissance Intel here we know that fry is presumably a user so let me get to this terminal all maximized obviously if we were to take a look at it seter password we do have a fry user available to us so what we might be able to do instead of using health check as just a temporary file that we create we could create like a symbolic link we could actually use Ln Tacs to create a linked file that will point to another file this is what I had intended for you to be able to do to actually get the health check file pointing to something else on the file system um if I were to create a health check based off of anything that that fry user that we knew from it set or password is in home if they're an interactive user they might have history hey the commands that they ran from the terminal and that's clued in from The Challenge prompts I note uhoh our friend fry has been typing at the keyboard and running all kinds of commands but his fingers are dirty so we could try to get their bash history file now I don't know if I have that syntax right no I'm always getting that wrong I do always get the parameters wrong uh so I have to actually swap those the order is different it should be the bash history file first and the file that we want to create health check following that now we should have health check in our current directory LS tacla would tell us let me zoom out a bit so it's actually visible for us health check is pointing to home fry. bash history with that we could use Curl now again with that being hosted on our Port 8000 just a simple pseudo Tac you to operate and act as that user fry curl 1271 8000 to our health check now when I hit enter on this there we go we get to read their bash history okay some nonsense in here but we do get to see SSH pass being used which usually supplies a password for SSH connections with tacp which Clues Us in that I love curly fries yum yum in my tum tum you can clip that uh that's the password for fry as our user now I got to admit I I think I had maybe muffed up the permissions I think even this user user as we are now could just straight up read fri. bash history file without needing to use Curl yeah I think I just had like the settings I think I had the permissions on that one modified so that would ensure and work but yeah anyone could read their uh bash history file with that though we do now know Fry's password so let me ssh in both of these shells to fry at localhost with their password and there we are as that fry user I'll do that one again down here just so we have a second one rolling for us and now we can start our numeration reconnaissance hey maybe looking around the file system all over again however there's not a lot to dig into before we keep cruising though I would like to give a special shout out and some love to the sponsor of today's video Black Hills information security anti- siphon training John Strand and the whole incredible tribe of companies that they are always up to doing fantastic stuff if you haven't seen them before in other videos I have showcased some of their pay what you can training which which is phenomenal by the way if you go to antiphon training you can find a link in the video description but in the training section you do have a pay what you can training that has a lot of phenomenal courses where you can literally just choose the price tag you can say how much you'd like to pay John strand himself does a lot of these and if you sign up I think if you go through Cent I think that's what handles the registration there's a button in a link to say look for tuition assistance click here and you can literally get access to the course for $0 all the folks there are absolutely genius incredible phenomenal fantastic people and John strand actually puts out a ton of These intro Labs out and about on GitHub completely available completely for free just on the internet you can go to github.com strand JS introl laabs and if you dig into the navigation the markdown file here you can see a ton of these lessons for like introduction to sock or the security Operation Center they have some on intro to security hey maybe some allow listing deny listing EDR great work there cyber deception active defense and we've covered some of these in a lot of other videos but actually I think one that might be especially pertinent to where up to in this video the web log review might be worthwhile to dig into how some web servers will actually log get artifacts and hey have some Telemetry when you're making HTTP requests like we're doing with curl or some of the others so super cool good stuff in there they include a virtual machine and a whole lot of the tooling definitely go check it out Link in the video description but now let's get back to our curly fries challenge because we've gained Privileges and access as the fry user but there wasn't more to dig into in their home directory again we are trying to escalate our privileges so why not once again we take a look at pseudo tacl looks like fry the user that we are can run commands as route without a password in the case of curl once again 1271 Port 8,000 health check again except this time with an asterisk which means we could Supply basically anything else that we want for curl we could keep adding on to the end of the command keep hey trying to add other arguments or parameters or things that we might be able to do with that maybe we were to actually take a look at curl okay guess inside the dock container we don't have the Man pages for the manual for curl so let me open up just another terminal on my host and let's take a look at the man page for curl now curl is to do some transfer with the URL and you could Supply any options or URLs as you would like a little bit more description and then way down below you can see all of the other arguments parameters Flags switches whatever you really want to call them for other functionality that you might be able to do with curl this is quite a hefty man page so there's a lot to read through if you wanted to explore all of it but I will speedrun us right towards the solution here because we could very well just get back to the terminal here use Curl as we would have maybe with pseudo we'll use pseudo Tac you root in this case 1271 Port 8,000 and we'll need health check once again now we don't have anything actually running on Port 8000 remember right now if we actually move back into the temporary directory in our other session let's make just another serve directory so we'll have something clean to work in I'll use Python 3 tacm HTP do server once again so we'll spin that up on Port 8000 but we should actually get some files over there so let me get over to Temp serve and we could create health check if we really wanted to but we could also just I don't know actually add on to the command that we're already building out with pseudo here because remember that asterisk that we saw in pseudo tacl output told us we can just keep adding whatever we want at the end which a wild card so what's to stop us from just actually trying to read a local file we could use the file schema rather than like HTTP as we might if we were trying to actually access our 1271 right HTTP or https is usually the schema there but there's nothing stopping us from doing the same thing with file and then trying to access anything we want we could actually I guess close down this HTTP server because we probably don't even need it right could we go ahead and read something like Etc shadow that is something that only root would be able to read and it looks like we can it's at rhadow which will include all the password hashes for different users this is an option and we could try to crack the password however it's a bad option it might take too much time we might not even get the password hash it could be anything so that's not ideal but we could do more with curl because why not try to save files the same way that curl usually allows us to add output with pack o we can store and save the contents in the other file that we might like if we tried to use that will we get health check as the first thing that we requested which we know errored or the file that we know errored what could we do here we could save a file we'll put this into temp serve I know we're already in that location but we'll call that file like log now if I LS oh do we have anything no is that because that just failed it might be let's add another tack of just to see can we save something else like the second thing that we request could we put that in temp serve data how about that oh that seemed to do something now we have data and if we actually were to take a look at that file it is it said password so we have arbitrary read now as the root user and arbitrary right where we can output this however only arbitrary in that okay it's something that we would have to get from the output of curl so curl has to be able to see that from someplace else but we just learned the trick in the previous step going from the user user to fry user we could just simply host whatever we wanted to on Port 8000 for our health check and then put that as our file to write now I know we could think outside the box here because this is SSH we've connected as fry so I'm curious does fry have SSH keys in SSH no it doesn't Okay so let's use SSH key gen and try to generate our own ID RSA or public and private key pair to log in through SSH would that work right LS tack. SSH now we have those files created do I actually have SSH present here I do so I could SSH into just Fry at localhost correct yes it would prompt for a password which we know but could we actually inside of the SSH file put the public key that we'll end up using into the like authoriz Keys folder like we have our public key right so what's to stop us from now using that as our authorized Keys file just as a proof of concept that way we could try to SSH with our own public and private key pairing and not be prompted for a password will that work it did it brought us right into Fry at curly fries if I try to exit here you can see that I'm in a subshell that'll bring me right back to where I usually was so idea putting the puzzle pieces together here we could copy the ID RSA public file that we have for our own public private key pairing let's go put that into serve temp where we oh sorry temp serve where we will go ahead and serve our HTTP instance Python 3 TM HTTP do server Port 8000 again now that could ultimately act as our health check file right let's go back down to our server and let's actually move our ida. Pub into our health check file and then let's use our curl command above to curl down health check which should give us oh actually let's start the service I am dumb now we could see that output can we actually just write this to roots. SSH folder and their own authorized keys and before I hit enter on this just to validate um let's another SSH session down below that way we could validate if I were to try to connect to root at Local Host I can't write now without knowing their password which we don't know so we'll have to bail out of that but if we use this trick to have the health check be the public key that we've created put that and store it write it as roots authorized keys I'll hit enter here and fingers crossed now we should be able to use our public private key pairing that we generated for this fry user as the same one that root would be able to accept and understand right can I SSH to root at localhost let me clear the screen here fingers crossed we are root and that's all it took you could do some other clever tricks there you could I don't know manipulate curl however you'd like with the other command line arguments arbitrary read arbitrary write you have that capability with that using that misconfiguration in pseudo Tac L but obviously getting into our home directory now we have a get flag random suffix the reason that I did that was so that you had to get a full-blown shell because you could do like again whatever file inclusion that you wanted to you could just read a flag. text but I wanted you to get a little bit clever get a little bit creative and think okay how can you get a full-blown shell so executing get flag random suffix does require you to press enter within 1 second to retrieve the flag I like to do that in a binary so that way it validates that you are in an interactive session so we have the flag and we have solved that challenge curly fries just for some gimmick just for some tricks just what we might be able to do with curl with an asterisk in the pseudo file you should never really have an asterisk there that is absolutely opening the door for abuse and whatever threat actor adversary hacker is going to do for privilege escalation quick showcase for this one but hey thank you so much for watching I hope you enjoyed this video I hope you enjoyed the ncon capture the flag competition if you happen to play it or at least some of the writeups some of the solutions some of this video showcase here and please please please give some love to our sponsors they're really the only way this channel can keep doing what it's doing Link in the video description big shout out big thanks to antiphon training Black Hills information security John Strand and all the Incredible Crew Please do show them some love thanks so much I'll see you in the next video