Insecure File Permissions
In order to leverage insecure file permissions we need to find a file that allows us write access but is executed at a higher privilege level.
Abusing Cron Jobs
Let's view /var/log/syslog for "CRON" logs. Alternatively, could also inspect the cron log file (/var/log/cron.log) for running cron jobs:
user_backups.sh under /home/joe/ is executed in the context of the root user.
We can replace user_backups.sh with our own script, a reverse shell, is a nice choice!
Replace with Reverse Shell
Create Listener
Abusing Password Authentication
It's possible for Linux to utilize a centralized repository to manage passwords such as LDAP or Active Directory, however passwords are generally stored in /etc/shadow.
Abusing older /etc/passwd permissions.
In older versions of UNIX, the password has was stored in /etc/passwd. If we come across an /etc/passwd file that contains a password hash we can crack it and assume it'll work for authentication.
Likewise, we can attempt to add a generate a password hash with openssl and add it to the /etc/passwd file.
Last updated