Sinisterly
How To Find If Your Kernel Is Vuln To Public Local Root Exploitation - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: How To Find If Your Kernel Is Vuln To Public Local Root Exploitation (/Thread-How-To-Find-If-Your-Kernel-Is-Vuln-To-Public-Local-Root-Exploitation)

Pages: 1 2

How To Find If Your Kernel Is Vuln To Public Local Root Exploitation - BreShiE - 01-28-2014

This will be a quick tutorial on how to find out if your server (or your shelled server) has a vulnerable kernel version to either local root exploitation or privilege escalation.

This tutorial should also hopefully give you a better understanding of Linux commands.

First of all, make sure you're not root already by doing the following command:
Code:
whoami

What this command does, is ask the system who you currently are as a user. Full Linux description:
Code:
Usage: whoami [OPTION]... Print the user name associated with the current effective user ID. Same as id -un. --help display this help and exit --version output version information and exit Report whoami bugs to bug-coreutils@gnu.org GNU coreutils home page: <http://www.gnu.org/software/coreutils/> General help using GNU software: <http://www.gnu.org/gethelp/> Report whoami translation bugs to <http://translationproject.org/team/> For complete documentation, run: info coreutils 'whoami invocation'


Here's an example of an output:
Spoiler:
[Image: 6ALMB.png]

As you can see from this image, the server is telling me I'm currently on the user "apache".



So, are you already root? If not, proceed to do the following command:
Code:
uname -r

This command displays specific information about your system. The "-r" command stands for "release" and will display exactly what information we need to know about the kernel. Full Linux description:

Code:
Usage: uname [OPTION]... Print certain system information. With no OPTION, same as -s. -a, --all print all information, in the following order, except omit -p and -i if unknown: -s, --kernel-name print the kernel name -n, --nodename print the network node hostname -r, --kernel-release print the kernel release -v, --kernel-version print the kernel version -m, --machine print the machine hardware name -p, --processor print the processor type or "unknown" -i, --hardware-platform print the hardware platform or "unknown" -o, --operating-system print the operating system --help display this help and exit --version output version information and exit Report uname bugs to bug-coreutils@gnu.org GNU coreutils home page: <http://www.gnu.org/software/coreutils/> General help using GNU software: <http://www.gnu.org/gethelp/> Report uname translation bugs to <http://translationproject.org/team/> For complete documentation, run: info coreutils 'uname invocation'

Here's an example of an output you can receive:
Spoiler:
[Image: 6AMRX.png]


Now, we have the most important information. From this we can find out if our kernel version is exploitable. My uname -r returns:
Code:
2.6.32-220.7.1.el6.x86_64

What we're mainly interested in though, is everything before the hyphen (-).

So this part:
Code:
2.6.32

Now with this, we can head over to Google and search to see if there's a publicly released exploit for it. How I do it, is just search the kernel section we have like so:
Code:
2.6.32 local root exploit
https://www.google.com/search?q=2.6.32+local+root+exploit&oq=2.6.32+local+root+exploit

or

Code:
2.6.32 privilege escalation
https://www.google.com/search?q=2.6.32+privilege+escalation&oq=2.6.32+privilege+escalation

RE: How To Find If Your Kernel Is Vuln To Public Local Root Exploitation - Edward - 01-28-2014

Pretty basic, but some people might not know this. Thanks for sharing.

RE: How To Find If Your Kernel Is Vuln To Public Local Root Exploitation - BreShiE - 01-28-2014

The tutorial is to mainly focus on getting people to use the command line in shells rather then just uploading their shells and doing fuck all with it. Trying to spark initiative in people. Smile

RE: How To Find If Your Kernel Is Vuln To Public Local Root Exploitation - Edward - 01-28-2014

(01-28-2014, 02:31 AM)BreShiE Wrote: The tutorial is to mainly focus on getting people to use the command line in shells rather then just uploading their shells and doing fuck all with it. Trying to spark initiative in people. Smile

It's just basic Linux usage. If they don't understand how to use Linux, how can you expect them to compromise a machine running Linux? Would make absolutely no sense.

RE: How To Find If Your Kernel Is Vuln To Public Local Root Exploitation - BreShiE - 01-28-2014

(01-28-2014, 02:35 AM)Myongs Cat Wrote: It's just basic Linux usage. If they don't understand how to use Linux, how can you expect them to compromise a machine running Linux? Would make absolutely no sense.

As I said, I'm hoping to spark initiative to learn.

RE: How To Find If Your Kernel Is Vuln To Public Local Root Exploitation - Cyanide and Cynicism - 01-28-2014

(01-28-2014, 02:41 AM)BreShiE Wrote: As I said, I'm hoping to spark initiative to learn.

thing is, most people on here wont even attempt to learn.

RE: How To Find If Your Kernel Is Vuln To Public Local Root Exploitation - BreShiE - 01-28-2014

(01-28-2014, 02:45 AM)gentoo_fetishism Wrote: thing is, most people on here wont even attempt to learn.

How will we know that if we don't at least try?

RE: How To Find If Your Kernel Is Vuln To Public Local Root Exploitation - Cyanide and Cynicism - 01-28-2014

(01-28-2014, 02:51 AM)BreShiE Wrote: How will we know that if we don't at least try?

Not saying the effort was useless, all I said was that they most likely wont try (and even if they do they'll fail).

RE: How To Find If Your Kernel Is Vuln To Public Local Root Exploitation - Adorapuff - 01-28-2014

Quote:2.6.32-220.7.1.el6.x86_64

What we're mainly interested in though, is everything before the hyphen (-).
I'm going to disagree here.
I've run into many kernels that start with say the 2.6.32 as mentioned, but the revision removes the vulnerability. At least go right after the hyphen to 220. You should be fine running the 2.6.32 exploit, but if it does not work try and be more specific.
Never the less, great tutorial BreShie. Now kiddies, don't havij a site, find a vuln on exploitdb, figure out how it works, what causes it, and understand the exploit code. Using that exploit you understand, go and "pwn a site", root it, and have some fun. I guarantee its more fun then havij (From personal experience as I used to use havij in the past but not any more), a lot more satisfactory, and you understand whats going on so you can learn something. Now that you can dissect 0days, you can write your own. exploitdb is flooded with wordpress themes for a reason. Its because for the most part, they all have the same vulnerabilities going on. Download some themes from mafiashare and find some vulns, release them, and don't be a skid.

tldr; read it

RE: How To Find If Your Kernel Is Vuln To Public Local Root Exploitation - tropic - 02-22-2014

(01-28-2014, 02:28 AM)BreShiE Wrote: Now, we have the most important information. From this we can find out if our kernel version is exploitable. My uname -r returns:
Code:
2.6.32-220.7.1.el6.x86_64

What we're mainly interested in though, is everything before the hyphen (-).

I disagree. RHEL/Centos boxes use backported kernels. A skid who is unaware of this will run an exploit for '2.6.32' without taking in regard the date when the particular kernel was compiled. This is why pasting the unames of backported kernels to ksplice inspector is futile. The part where it shows '220.7.1' is useful because you can look it up and view repo/git/launchpad comments on vulnerabilities.

A backported kernel may not be vulnerable to some of the newer exploits, conversely, it may also contain a vulnerability which has been patched in other kernels due to neglect (refer to CVE-2010-3081 and CVE-2013-2094) .