[BreShiE]

This will be a quick tutorial on how to find out if your server (or your shelled server) has a vulnerable kernel version to either local root exploitation or privilege escalation.

This tutorial should also hopefully give you a better understanding of Linux commands.

First of all, make sure you're not root already by doing the following command:

Code:

whoami

What this command does, is ask the system who you currently are as a user. Full Linux description:

Code:

Usage: whoami [OPTION]... Print the user name associated with the current effective user ID. Same as id -un. --help display this help and exit --version output version information and exit Report whoami bugs to bug-coreutils@gnu.org GNU coreutils home page: <http://www.gnu.org/software/coreutils/> General help using GNU software: <http://www.gnu.org/gethelp/> Report whoami translation bugs to <http://translationproject.org/team/> For complete documentation, run: info coreutils 'whoami invocation'

Here's an example of an output:

Spoiler:

As you can see from this image, the server is telling me I'm currently on the user "apache".

So, are you already root? If not, proceed to do the following command:

Code:

uname -r

This command displays specific information about your system. The "-r" command stands for "release" and will display exactly what information we need to know about the kernel. Full Linux description:

Code:

Usage: uname [OPTION]... Print certain system information. With no OPTION, same as -s. -a, --all print all information, in the following order, except omit -p and -i if unknown: -s, --kernel-name print the kernel name -n, --nodename print the network node hostname -r, --kernel-release print the kernel release -v, --kernel-version print the kernel version -m, --machine print the machine hardware name -p, --processor print the processor type or "unknown" -i, --hardware-platform print the hardware platform or "unknown" -o, --operating-system print the operating system --help display this help and exit --version output version information and exit Report uname bugs to bug-coreutils@gnu.org GNU coreutils home page: <http://www.gnu.org/software/coreutils/> General help using GNU software: <http://www.gnu.org/gethelp/> Report uname translation bugs to <http://translationproject.org/team/> For complete documentation, run: info coreutils 'uname invocation'

Here's an example of an output you can receive:

Spoiler:

Now, we have the most important information. From this we can find out if our kernel version is exploitable. My uname -r returns:

Code:

2.6.32-220.7.1.el6.x86_64

What we're mainly interested in though, is everything before the hyphen (-).

So this part:

Code:

2.6.32

Now with this, we can head over to Google and search to see if there's a publicly released exploit for it. How I do it, is just search the kernel section we have like so:

Code:

2.6.32 local root exploit

https://www.google.com/search?q=2.6.32+l...ot+exploit

or

Code:

2.6.32 privilege escalation

https://www.google.com/search?q=2.6.32+p...escalation