| Command | Description |
|---|---|
find / -type f \( -name *_hist -o -name *_history \) -exec ls -l {} \; 2>/dev/null | Find all accessible history files |
find / -path /proc -prune -o -type d -perm -o+w 2>/dev/null | Find world-writeable directories |
find / -type d -name ".*" -ls 2>/dev/null | Find all hidden directories |
find / -type f -name ".*" -exec ls -l {} \; 2>/dev/null | Find all hidden files |
find / -path /proc -prune -o -type f -perm -o+w 2>/dev/null | Find world-writeable files |
find / -user root -perm -4000 -exec ls -ldb {} \; 2>/dev/null | Find binaries with SUID bit set |
find / -user root -perm -6000 -exec ls -ldb {} \; 2>/dev/null | Find binaries with SGID bit set |
find /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -type f -exec getcap {} \; | Enumerate binary files capabilities |
find / ! -path "*/proc/*" -iname "*config*" -type f 2>/dev/null | Search config files |
find / -type f \( -name *.conf -o -name *.config \) -exec ls -l {} \; 2>/dev/null | Search config files |
find / -type f -name "*.sh" 2>/dev/null \| grep -v "src\|snap\|share" | Find .sh scripts |
grep -r "word" /starting-path | Resursively inspect file contents to find instances of "word": |
ls -l /tmp /var/tmp /dev/shm | Find temporary files |
> > `$PATH` is an environment variable that **specifies the set of directories where an executable can be located**. > > An account's `$PATH` variable is a set of absolute paths, **allowing a user to type a command without specifying the absolute path to the binary**. > > For example, a user can type `cat /tmp/test.txt` instead of specifying the absolute path `/bin/cat /tmp/test.txt`. > > Creating a script or program in a directory specified in the `$PATH` will make it executable from any directory on the system. **Interacting with the PATH variable:** * Check the contents of the PATH variable: `env | grep PATH` or `echo $PATH` * Adding `.` to a user's PATH adds their current working directory to the list. * To add a specific directory at the top of the PATH list: `export PATH=/tmp:$PATH` * To add the current working directory at the top of the PATH list: `export PATH=.:$PATH` **Abusing the PATH variable:** * **Prerequisites:** a program or script running as root and its source code (or part of it) * **Example Exploitation Steps:** * Suppose we can read the source code of a program * Suppose the source code reveals that the program makes use of a command or script without specifying its full path * e.g. The program uses `echo something` instead of `/usr/bin/echo something` * In that case, we can write and compile a C program with the same name as the command/script (`echo`) that gives us a reverse shell * After that, edit the PATH variable in order to prepend the exploit's directory on top (`export PATH=/dir-to-exploit:$PATH`) * Run the vulnerable program and get the reverse shell as root * **Explaination:** the program tries to run the echo command, but it needs to look at the PATH variable since the command's full (absolute) path was not specified. The PATH variable's first directory will be the folder containing the exploit code, which will be ran by the program instead of the "real" echo command. The exploit code will be ran using the program's privileges (root), allowing us to escalate privileges *** ## **LD\_PRELOAD Abuse** > **What is the purpose of the LD\_PRELOAD variable?** > > `LD_PRELOAD` is an optional environmental variable containing one or more paths to shared libraries, or shared objects > > All shares libraries/objects specified by this variable will be loaded (preloaded) before any other shared library **Prerequisites to abuse the LD\_PRELOAD variable:** * Suppose to have a script running as root * Suppose you can read the source code of that script * Alternatively, use `ldd /bin/scriptname` in order to view the shared objects required by a binary * To abuse ld\_preload, you need to write a C code containing the `same signature of a function used by the program` * This means that: * All `#include` statements are the same as the original function's * The `return value` needs to be the same as the original function's **Example PoC code:** ``` #include