search
Page cover

Bash eq Privilege Escalation

The `-eq` comaparison in bash script is vulnerable to arbitrary command execution.

hashtag
Investigationarrow-up-right

Please see this postarrow-up-right for details.

sudo -l

(root) /bin/bash /opt/example.sh
Copied!

If we can execute above command as root, and the /opt/example.sh contains the numeric comparison such as [[ $var -eq 42 ]], we can execute arbitrary command.

#!/bin/bash

read -rp "Enter guess: " num

if [[ $num -eq 42 ]]
then
  echo "Correct"
else
  echo "Wrong"
fi
Copied!

To execute arbitrary command, answer this question as below.

inject arbitrary command before the correct number (42).

hashtag
Exploitation (Get a Shell Directly)arrow-up-right

It’s easy if we can execute the bash script as root. We only need to insert /bin/sh or /bin/bash command in the answer.

hashtag
Exploitation (Get a Shell Indirectly)arrow-up-right

We can also inject a bash script and execute arbitrary code. First, create a reverse shell script /tmp/shell.elf using msfvenom.

Then start a listener in local machine.

Now execute the bash script as root.

We should get a root shell in local terminal.

hashtag
References

PreviousApache Conf Privilege EscalationNextBuffer Overflow Privilege Escalation

Last updated