Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Empty /etc/passwd after auto escalation

See original GitHub issue

Bug Description

Pwncat cleared the /etc/passwd file

pwncat version

$ pwncat --version
0.4.3

Target System (aka “victim”)

Peak Hill

Steps to Reproduce

Using gASVLQAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjBJjaG1vZCArcyAvYmluL2Jhc2iUhZRSlC4= as payload for the privesc located at /opt/peak_hill_farm/peak_hill_farm we make the bash file a suid.

Then we run on local shell run enumerate.gather clear=True to clear our local cache to enable auto escalation. Afterwards we run run enumerate.gather to try and get the suid file in pwncat’s cache Running escalate list gives the following:

- add user using file write as root via /bin/bash (SUID) from root (linux.enumerate.file.suid)      
- shell as root via /bin/bash (SUID) from root (linux.enumerate.file.suid)                          
- implant: Private key owned by dill at /home/dill/.ssh/id_rsa                                      - implant: Private key owned by root at /root/.ssh/id_rsa

This would suggest we are able to get a root shell. Thus we run escalate run resulting in an empty /etc/passwd

Expected Behavior

For it to give me root bash shell and not clear out the /etc/passwd file

I think adding a priority to a route to root would be helpful. I think it goes down the list in order, however getting a shell through bash would be much easier and less noisy than getting it through a new user via writing to /etc/passwd. Thus “shell as root via /bin/bash” should be higher priority than “add user using file write as root”

Screenshot

Don’t have a screenshot but I did this live on twitch vod is here: https://www.twitch.tv/videos/1109027911?t=03h33m34s

Issue Analytics

State:
Created 2 years ago
Comments:5 (4 by maintainers)

Top GitHub Comments

1reaction

WesVleutencommented, Aug 8, 2021

That’s no problem! I already looked into it and created #176 which resolves this. So when they get back, they would only need to review the changes!

0reactions

calebstewartcommented, Sep 4, 2021

I’ve created a new branch to work on this. I’m working to remove all remnants of the base64 stream type. This will take some extra testing to make sure I don’t break anything (although it /shouldn’t/). I’m closing this pull request in the meantime, though.

Top Results From Across the Web

Empty password field in /etc/passwd

An empty password field means the root account can be accessed without any password. An * or ! means the account don't have...

Cannot lock /etc/passwd; try again later - Super User

By looking at strace output, I saw useradd chrooted into the specified directory, after which of course it cannot find /etc/passwd anymore.

Linux Privilege Escalation - Cyber Security Consulting

Writable /etc/passwd First generate a password with one of the following commands. Then add the user hacker and add the generated password. Alternatively...

Understanding /etc/shadow file format on Linux - nixCraft

So the file passwd is run as the root user. And that is how normal users can escalate permission to edit their password...

Weak File Permissions – Writable /etc/passwd | Infinite Logins

Linux Privilege Escalation: Weak File Permissions – Writable /etc/passwd · Method 1 – Overwriting root password · Method 2 – Creating a new...