45 lines
4.3 KiB
Markdown
45 lines
4.3 KiB
Markdown
### Working with Temporary Directories in RCE Exploits:
|
||
|
||
#### 1. **Alternate Temporary Directories**:
|
||
|
||
- **Typical Situation**: When executing code remotely on a Linux server, payloads often need to be stored in a temporary directory such as `/tmp`. However, some systems may restrict access to `/tmp` or clear it periodically, which could interrupt or prevent payload execution.
|
||
- **Solution**: Use `/dev/shm/` instead.
|
||
- **/dev/shm/** is an in-memory filesystem (tmpfs) on Linux, commonly used for temporary file storage with higher I/O performance since it resides in memory rather than on disk.
|
||
- **Advantages**:
|
||
- Less likely to be cleared automatically, especially if `/tmp` is periodically purged by the system.
|
||
- Provides faster access speeds for payload execution.
|
||
- Accessible to non-root users by default on many systems, making it ideal for user-level code execution.
|
||
- `/dev/shm/` is generally world-writable, meaning any user can write files here.
|
||
|
||
#### 2. **Using Other World-Writable Directories**:
|
||
|
||
- If both `/tmp` and `/dev/shm/` are unavailable, consider other locations:
|
||
- **/var/tmp/**: Another temporary directory, though typically less frequently cleared than `/tmp`.
|
||
- **User home directories**: If the user running the web application service has a home directory, you may find writable directories here. However, these can vary in permissions.
|
||
- **Application-specific directories**: Some web applications may have writable directories for uploads, cache, or session storage. Checking for world-writable application directories (e.g., `/var/www/html/uploads/` for web applications) can yield alternative options for payload storage.
|
||
|
||
---
|
||
|
||
### Understanding `PrivateTmp=true` in Apache and Other Services:
|
||
|
||
- **PrivateTmp Setting**:
|
||
|
||
- If a service like `apache.service` has `PrivateTmp=true` in its systemd configuration (`/etc/systemd/system/apache.service` or `/lib/systemd/system/apache.service`), the service is configured with an isolated, private temporary directory, separate from the system’s global `/tmp` and `/var/tmp/`.
|
||
- **Implication**: The service’s `/tmp` and `/var/tmp` are effectively "sandboxed," meaning that any files written to `/tmp` by Apache (or another service with this setting) won’t be accessible from the global `/tmp` path, which could affect payload storage or retrieval.
|
||
- **Path Differences**: For example, the actual temporary directories may appear under:
|
||
- `/tmp/systemd-private-<unique-id>-apache.service-<random>/tmp/`
|
||
- This directory is created by systemd for services with `PrivateTmp=true`, effectively isolating the service's `/tmp` space from other processes.
|
||
- **Bypassing PrivateTmp**:
|
||
|
||
- **Use `/dev/shm/`** or other directories unaffected by `PrivateTmp` to store files that need to be accessible system-wide.
|
||
- **Modify systemd configuration** (if possible with higher privileges): Setting `PrivateTmp=false` within the `apache.service` file and restarting the service may disable the isolated temporary storage, reverting the application to the global `/tmp` directory. However, this change requires root or appropriate sudo privileges.
|
||
- **Other File Paths**: Even with `PrivateTmp=true`, paths like `/dev/shm/` and `/var/tmp/` remain globally accessible, so they can still be used as viable alternatives.
|
||
|
||
---
|
||
|
||
### Additional Tips for RCE Payload Handling:
|
||
|
||
- **Environment Variables**: Some RCE exploits allow manipulation of environment variables. If possible, set variables such as `TMPDIR=/dev/shm/` within the application, which may direct temporary files to your chosen directory.
|
||
- **Upload Shells or Payloads**: If the application allows for file uploads (e.g., image or document uploads), try uploading a payload to an accessible directory rather than relying on `/tmp` or `/dev/shm/`.
|
||
- **Custom Service Configurations**: Sometimes, application-specific configuration files (e.g., PHP `open_basedir` restrictions) or Apache directives like `php_admin_value` might restrict file access. Check for these restrictions in web server configuration files such as `httpd.conf` or `.htaccess` files if you can access them.
|
||
- **Webshells and Command Execution**: If possible, establish a web shell that allows direct command execution and file navigation, giving more flexibility in handling these directory restrictions. |