Bash eq Privilege Escalation
The `-eq` comaparison in bash script is vulnerable to arbitrary command execution.
Please see this post for details.
sudo -l
(root) /bin/bash /opt/example.sh
Copied!If we can execute above command as root, and the /opt/example.sh contains the numeric comparison such as [[ $var -eq 42 ]], we can execute arbitrary command.
#!/bin/bash
read -rp "Enter guess: " num
if [[ $num -eq 42 ]]
then
echo "Correct"
else
echo "Wrong"
fi
Copied!To execute arbitrary command, answer this question as below.
inject arbitrary command before the correct number (42).
It’s easy if we can execute the bash script as root.
We only need to insert /bin/sh or /bin/bash command in the answer.
We can also inject a bash script and execute arbitrary code.
First, create a reverse shell script /tmp/shell.elf using msfvenom.
Then start a listener in local machine.
Now execute the bash script as root.
We should get a root shell in local terminal.
References
Last updated