InfoSec LAB

workaholic_wp-monitor

Created: 3 min read

wp-monitor

An unknown SUID binary has been identified on the workaholic host; /var/www/html/wordpress/blog/wp-monitor

The binary has SUID bit set. This was flagged by PEAS as well.

charlie@workaholic:/dev/shm$ /var/www/html/wordpress/blog/wp-monitor
[+] Checking the logs...
[!] This can take a while...

Executing the binary doesn’t seem to do anything with PSPY running in the background.

charlie@workaholic:~$ strings /var/www/html/wordpress/blog/wp-monitor 
/lib64/ld-linux-x86-64.so.2
A.c-eW^
fgets
strcpy
puts
perror
__stack_chk_fail
dlclose
setuid
fopen
__libc_start_main
stderr
fprintf
dlsym
dlopen
__cxa_finalize
dlerror
fclose
__isoc99_sscanf
fwrite
strcmp
libc.so.6
GLIBC_2.7
GLIBC_2.4
GLIBC_2.2.5
GLIBC_2.34
_ITM_deregisterTMCloneTable
__gmon_start__
_ITM_registerTMCloneTable
PTE1
u+UH
/var/log/nginx/access.log
Error opening log file
%s - - [%*[^]]] "%s %s %s" %s
POST /wp-login.php
[Warning] Possible brute force attack detected: %s
[+] Checking the logs...
/home/ted/.lib/libsecurity.so
[!] This can take a while...
init_plugin
[!] Function not found in the library!
9*3$"
GCC: (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0
Scrt1.o
__abi_tag
crtstuff.c
deregister_tm_clones
__do_global_dtors_aux
completed.0
__do_global_dtors_aux_fini_array_entry
frame_dummy
__frame_dummy_init_array_entry
wp-monitor.c
__FRAME_END__
_DYNAMIC
__GNU_EH_FRAME_HDR
_GLOBAL_OFFSET_TABLE_
dlerror@GLIBC_2.34
__libc_start_main@GLIBC_2.34
_ITM_deregisterTMCloneTable
strcpy@GLIBC_2.2.5
puts@GLIBC_2.2.5
_edata
fclose@GLIBC_2.2.5
_fini
__stack_chk_fail@GLIBC_2.4
fgets@GLIBC_2.2.5
__data_start
strcmp@GLIBC_2.2.5
dlopen@GLIBC_2.34
fprintf@GLIBC_2.2.5
__gmon_start__
__dso_handle
_IO_stdin_used
__isoc99_sscanf@GLIBC_2.7
_end
check_bruteforce
__bss_start
main
fopen@GLIBC_2.2.5
perror@GLIBC_2.2.5
dlsym@GLIBC_2.34
fwrite@GLIBC_2.2.5
__TMC_END__
_ITM_registerTMCloneTable
setuid@GLIBC_2.2.5
dlclose@GLIBC_2.34
__cxa_finalize@GLIBC_2.2.5
_init
stderr@GLIBC_2.2.5
.symtab
.strtab
.shstrtab
.interp
.note.gnu.property
.note.gnu.build-id
.note.ABI-tag
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rela.dyn
.rela.plt
.init
.plt.got
.plt.sec
.text
.fini
.rodata
.eh_frame_hdr
.eh_frame
.init_array
.fini_array
.dynamic
.data
.bss
.comment

Running the strings command reveals a suggestive string; /home/ted/.lib/libsecurity.so It might be loading that shared object.

Shared Object

charlie@workaholic:~$ strace /var/www/html/wordpress/blog/wp-monitor 2>&1
execve("/var/www/html/wordpress/blog/wp-monitor", ["/var/www/html/wordpress/blog/wp-"...], 0x7ffddf9a6150 /* 22 vars */) = 0
brk(NULL)                               = 0x596676201000
fcntl(0, F_GETFD)                       = 0
fcntl(1, F_GETFD)                       = 0
fcntl(2, F_GETFD)                       = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7358a203d000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=23983, ...}) = 0
mmap(NULL, 23983, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7358a2037000
close(3)                                = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\243\2\0\0\0\0\0"..., 832) = 832
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
fstat(3, {st_mode=S_IFREG|0755, st_size=2125328, ...}) = 0
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
mmap(NULL, 2170256, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7358a1e00000
mmap(0x7358a1e28000, 1605632, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x28000) = 0x7358a1e28000
mmap(0x7358a1fb0000, 323584, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1b0000) = 0x7358a1fb0000
mmap(0x7358a1fff000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1fe000) = 0x7358a1fff000
mmap(0x7358a2005000, 52624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7358a2005000
close(3)                                = 0
mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7358a2034000
arch_prctl(ARCH_SET_FS, 0x7358a2034740) = 0
set_tid_address(0x7358a2034a10)         = 21862
set_robust_list(0x7358a2034a20, 24)     = 0
rseq(0x7358a2035060, 0x20, 0, 0x53053053) = 0
mprotect(0x7358a1fff000, 16384, PROT_READ) = 0
mprotect(0x5966752b3000, 4096, PROT_READ) = 0
mprotect(0x7358a2075000, 8192, PROT_READ) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
munmap(0x7358a2037000, 23983)           = 0
setuid(0)                               = -1 EPERM (Operation not permitted)
fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(0x88, 0), ...}) = 0
getrandom("\x1c\xa8\xfb\x08\xd4\x0e\x18\x7e", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x596676201000
brk(0x596676222000)                     = 0x596676222000
write(1, "[+] Checking the logs...\n", 25[+] Checking the logs...
) = 25
openat(AT_FDCWD, "/var/log/nginx/access.log", O_RDONLY) = -1 EACCES (Permission denied)
dup(2)                                  = 3
fcntl(3, F_GETFL)                       = 0x2 (flags O_RDWR)
fstat(3, {st_mode=S_IFCHR|0620, st_rdev=makedev(0x88, 0), ...}) = 0
write(3, "Error opening log file: Permissi"..., 42Error opening log file: Permission denied
) = 42
close(3)                                = 0
openat(AT_FDCWD, "/home/ted/.lib/libsecurity.so", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
write(2, "[!] This can take a while...", 28[!] This can take a while...) = 28
exit_group(1)                           = ?
+++ exited with 1 +++

Executing the SUID binary with strace reveals that it indeed attempted to open the shared object, /home/ted/.lib/libsecurity.so, but failed to do so as the file does not exist.

Interestingly, the home directory of the ted user is world-writable

While the /home/ted/.lib directory and the shared object file is missing, it would be possible to create it due to the lack of access control. Moving on to the Privilege Escalation phase.

Interactive Graph View

Backlinks