Empty /etc/passwd after auto escalation
See original GitHub issueBug Description
Pwncat cleared the /etc/passwd file
pwncat version
$ pwncat --version
0.4.3
Target System (aka “victim”)
Peak Hill
Steps to Reproduce
Using gASVLQAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjBJjaG1vZCArcyAvYmluL2Jhc2iUhZRSlC4=
as payload for the privesc located at /opt/peak_hill_farm/peak_hill_farm we make the bash file a suid.
Then we run on local shell run enumerate.gather clear=True
to clear our local cache to enable auto escalation.
Afterwards we run run enumerate.gather
to try and get the suid file in pwncat’s cache
Running escalate list
gives the following:
- add user using file write as root via /bin/bash (SUID) from root (linux.enumerate.file.suid)
- shell as root via /bin/bash (SUID) from root (linux.enumerate.file.suid)
- implant: Private key owned by dill at /home/dill/.ssh/id_rsa - implant: Private key owned by root at /root/.ssh/id_rsa
This would suggest we are able to get a root shell. Thus we run escalate run
resulting in an empty /etc/passwd
Expected Behavior
For it to give me root bash shell and not clear out the /etc/passwd file
I think adding a priority to a route to root would be helpful. I think it goes down the list in order, however getting a shell through bash would be much easier and less noisy than getting it through a new user via writing to /etc/passwd. Thus “shell as root via /bin/bash” should be higher priority than “add user using file write as root”
Screenshot
Don’t have a screenshot but I did this live on twitch vod is here: https://www.twitch.tv/videos/1109027911?t=03h33m34s
Issue Analytics
- State:
- Created 2 years ago
- Comments:5 (4 by maintainers)
That’s no problem! I already looked into it and created #176 which resolves this. So when they get back, they would only need to review the changes!
I’ve created a new branch to work on this. I’m working to remove all remnants of the
base64
stream type. This will take some extra testing to make sure I don’t break anything (although it /shouldn’t/). I’m closing this pull request in the meantime, though.