Exploiting Kernel Vulnerabilities
Kernel exploits are an excellent way to escalate privileges,
but our success may depend on matching not only the target’s kernel version,
but also the operating system flavor, such as Debian, RHEL, Gentoo, etc.
To demonstrate this attack vector
we will first gather information about our Ubuntu target
by inspecting the /etc/issue file.
As discussed earlier in the Topic,
this is a system text file that contains a message or system identification
to be printed before the login prompt on Linux machines.
Next, we will inspect the kernel version and system architecture
using standard system commands.
The output reveals the target system’s Ubuntu version,
specific kernel, and that it is running on the x86 64 architecture.
Armed with this information, we can use searchsploit on our local Kali system
to find kernel exploits matching the target version.
We want to use “linux kernel Ubuntu 16 Local Privilege Escalation”
as our main keywords.
We also want to filter out some clutter from the output,
so we’ll exclude anything below kernel version 4.4.0 and anything that matches
kernel version 4.8.
Let’s try the last exploit, since it seems to be newer and also matches
our kernel version as it targets any version below 4.13.9.
We’ll use gcc on Linux to compile our exploit,
keeping in mind that when compiling code,
we must match the architecture of our target.
This is especially important in situations where the target machine does not have
a compiler and we are forced to compile the exploit on our attacking machine
or in a sandboxed environment that replicates the target OS and architecture.
Although learning every detail of a Linux kernel exploit
is outside the scope of this Topic,
we still need to understand the initial compilation instructions.
To do so, let’s copy the exploit into our Kali home folder.
And then inspect the first 20 lines of it to spot any compilation instructions.
Luckily, to compile the source code into an executable,
we just need to invoke gcc and specify the C source code and the output filename.
To simplify this process, we could also rename the source filename to match
the one expected by the exploit’s procedure.
Once renamed, we can simply paste the original exploit’s instructions
to compile the C code.
To make sure that the compilation process goes as smoothly as possible,
we take advantage of the fact that our target is already shipped with GCC.
For this reason we can compile and run the exploit on the target itself.
As a consequence of this we can take advantage of including the correct version
of the libraries required by the target’s architecture.
This setup will lower the risks related to any cross-compilation
compatibility issues.
To begin,
we transfer the exploit source code over the target machine via the SCP tool.
Once transferred, we connect to the target machine and invoke
GCC to compile the exploit,
providing the source code as the first argument,
and the binary name as the output file to the -o parameter.
We can safely assume gcc compiled it correctly
since it did not output any errors.
Using the file utility, we can also inspect the Linux ELF file architecture.
With all the prerequisites in place we are now ready to run
our Linux kernel privilege escalation exploit.
Great!
We managed to obtain a root shell by exploiting a known kernel vulnerability.
In this section, we learned how to manually enumerate our target
for any known kernel vulnerabilities.
We then discovered how to feed searchsploit our information
in order to select the right exploit source code.
Finally, we compiled the exploit and ran it against the target machine
to gain an administrative shell.