Inspecting Service Footprints
System daemons are Linux services that are spawned at boot time to perform
specific operations without any need for user interaction.
Linux servers are often configured to host numerous daemons,
like SSH, web servers, and databases, to mention a few.
System administrators often rely on custom daemons to execute ad-hoc tasks
and they sometimes neglect security best practices.
As part of our enumeration efforts,
we should inspect the behavior of running processes
to hunt for any anomaly that might lead to an elevation of privileges.
Unlike on Windows systems, on Linux we can list information
about higher-privilege processes such as the ones running inside
the root user context.
We can enumerate all the running processes with the ps command
and since it only takes a single snapshot of the active processes,
we can refresh it using the watch command.
We will run the ps command every second via the watch utility and grep the results
on any occurrence of the word “pass”.
We notice the administrator has configured a system daemon
that is connecting to the local system with eve’s credentials in clear text.
Most importantly, the fact that the process is running as root
does not prevent us from inspecting its activity.
Another more holistic angle we should take into consideration
when enumerating for privilege escalation
is to verify whether we have rights to capture network traffic.
tcpdump is the de facto command line standard for packet capture,
and it requires administrative access since it operates on raw sockets.
However, it’s not uncommon to find IT personnel accounts
have been given exclusive access to this tool for troubleshooting purposes.
To illustrate the concept, we can run tcpdump as the joe user
who has been granted specific sudo permissions to run it.
Let’s try to capture traffic in and out of the loopback interface,
then dump its content in ASCII using the -A parameter.
Ultimately, we want to filter any traffic containing the “pass” keyword.
After a few seconds we are prompted with the root user’s clear text credentials.
Nice!
These two examples provide an entry point for the many avenues available
when hunting for leaked credentials.
Having covered the low-hanging fruit,
next we’ll explore how to escalate privileges
via misconfigured file permissions.