Nothing Special   »   [go: up one dir, main page]
Scribd Logo
Upload

Welcome to Scribd!

  • 19 views

    Disk Group Privilege Escalation 1714302659

    Uploaded by

    dkfwvpyhw9

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Disk Group Privilege Escalation 1714302659

    Uploaded by

    dkfwvpyhw9
    19 views14 pages

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    19 views14 pages

    Disk Group Privilege Escalation 1714302659

    Uploaded by

    dkfwvpyhw9

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 14

    Disk Group Privilege Escalation

    Page | 1
    www.hackingarticles.in
    Disk Group Privilege Escalation

    Contents
    Overview............................................................................................................ 3
    Lab Setup ........................................................................................................... 3
    Configuration ..................................................................................................... 3
    Exploitation ........................................................................................................ 8
    Conclusion ....................................................................................................... 13

    Page | 2
    www.hackingarticles.in
    Disk Group Privilege Escalation

    Overview
    Disk Group Privilege Escalation is a complex attack method targeting
    vulnerabilities or misconfigurations within the disk group management system
    of Linux environments. Attackers might focus on disk devices such as /dev/sda,
    which represents the primary hard drive in Linux systems and is commonly
    associated with the first SCSI (Small Computer System Interface) disk device,
    during Disk Group Privilege Escalation attacks. Attackers exploit vulnerabilities or
    misconfigurations linked to /dev/sda and similar devices to gain unauthorized
    access to sensitive data or exploit associated vulnerabilities. By manipulating
    permissions or exploiting misconfigurations concerning disk devices, attackers
    aim to escalate their privileges or access critical system resources.

    Lab Setup
    In this article, we are going to exploit the disk group privilege escalation
    vulnerability on the ubuntu machine and obtain the root access. Following are
    the machines:
    Target Machine: Ubuntu (192.168.1.6)
    Attacker Machine: Kali Linux (192.168.1.7)

    Configuration
    Let’s start by creating a new user raj in the ubuntu machine.
    adduser raj

    Page | 3
    www.hackingarticles.in
    Disk Group Privilege Escalation

    Add the newly created raj user to the disk group using the following command:

    usermod -aG disk raj


    groups raj

    Install the openssh-server using the following command:

    apt install openssh-server

    Page | 4
    www.hackingarticles.in
    Disk Group Privilege Escalation

    Generate the ssh private key and public key for the root user using the following
    command:

    ssh-keygen
    mv id_rsa.pub authorized_keys

    By default, inside the sshd server system-wide configuration file options for
    PermitRootLogin and PubkeyAuthentication is commented out.

    Page | 5
    www.hackingarticles.in
    Disk Group Privilege Escalation

    Here, we need to perform two changes in the configuration file, the first one is
    changing the value of PermitRootLogin to yes and removing the comment (#)
    and second is removing the comment (#) on the PubKeyAuthentication.

    Page | 6
    www.hackingarticles.in
    Disk Group Privilege Escalation

    Page | 7
    www.hackingarticles.in
    Disk Group Privilege Escalation

    Now, after the configuration is complete restart the ssh service.

    service ssh restart


    service ssh status

    Exploitation

    Since the disk group misconfiguration vulnerability is a privilege escalation


    technique in linux, so we are taking an initial shell using the ssh service and as
    raj user to show the privilege escalation part using this vulnerability.

    ssh raj@192.168.1.6

    We can use the id command to verify the groups that raj user belongs to. It can
    be seen that raj is a member of disk group.

    To check the disk space summary for each mounted file in human-readable
    format we will use the following command:

    df -h

    Here we are going to consider the partition where the / (root) directory is
    mounted i.e., /dev/sda3.

    Page | 8
    www.hackingarticles.in
    Disk Group Privilege Escalation

    After the partition is selected, now to examine and modify the partition the
    debugfs utility can be used in linux. This utility can also be used to create a
    directory or read the contents of a directory.

    After creating a test directory using debugfs utility, it shows that the filesystem
    has read/only permissions. So, we can try here reading the ssh private key of
    root user so that we can login later using the ssh private key.

    debugfs /dev/sda3
    mkdir test
    cat /root/.ssh/id_rsa

    Page | 9
    www.hackingarticles.in
    Disk Group Privilege Escalation

    Since we are able to read the openssh private key of the root user, so we can
    copy the private key and paste in a file and give it limited permissions so that it
    should not be overly permissive private key.

    nano id_rsa
    chmod 600 id_rsa
    ssh -i id_rsa root@192.168.1.6

    Page | 10
    www.hackingarticles.in
    Disk Group Privilege Escalation

    id

    Observe that the privilege escalation is performed, and the attacker has the root
    access. Now we can read the /etc/shadow file and obtain the hashes of other
    users.

    Page | 11
    www.hackingarticles.in
    Disk Group Privilege Escalation

    Page | 12
    www.hackingarticles.in
    Disk Group Privilege Escalation

    Conclusion

    Disk Group Privilege Escalation is a major concern for the security of Linux
    systems. It allows attackers to gain unauthorized access to sensitive data and
    elevate their privileges. It's essential to grasp how this attack works and to
    establish robust security measures to protect against it. Doing so is vital for
    minimizing risks and ensuring systems remain safe from exploitation.

    Page | 13
    www.hackingarticles.in
    JOIN OUR
    TRAINING PROGRAMS
    H ERE
    CLICK BEGINNER

    Bug Bounty Network Security


    Ethical Hacking Essentials

    Network Pentest
    Wireless Pentest

    ADVANCED

    Burp Suite Pro Web Pro Computer


    Services-API Infrastructure VAPT Forensics

    Advanced CTF
    Android Pentest Metasploit

    EXPERT

    Red Team Operation

    Privilege Escalation
    APT’s - MITRE Attack Tactics
    Windows
    Active Directory Attack
    Linux
    MSSQL Security Assessment

    www.ignitetechnologies.in

    You might also like