{"id":1513,"date":"2021-04-22T20:40:00","date_gmt":"2021-04-22T18:40:00","guid":{"rendered":"https:\/\/mikadmin.fr\/blog\/?p=1513"},"modified":"2021-09-19T11:00:30","modified_gmt":"2021-09-19T09:00:30","slug":"linux-privilege-escalation-python-library-hijacking","status":"publish","type":"post","link":"https:\/\/mikadmin.fr\/blog\/linux-privilege-escalation-python-library-hijacking\/","title":{"rendered":"Linux Privilege Escalation : Python Library Hijacking"},"content":{"rendered":"<\/span> 3<\/span> min read<\/span><\/span>

Views: 3836<\/p>\n

<\/div>\n\n\n\n
\"python
https:\/\/tryhackme.com\/room\/commonlinuxprivesc<\/a><\/figcaption><\/figure><\/div>\n\n\n\n

Dans cet article, nous allons passer d’un utilisateur lambda<\/strong> sans droits \u00e0 l’utilisateur root<\/span><\/strong> \u00e0 l’aide d’un script python<\/a><\/span><\/strong> et de la technique \u00ab\u00a0python library hijacking<\/strong>\u00ab\u00a0.<\/p>\n\n\n\n

\n\n\n\n

Python Library Hijacking :<\/strong><\/p>\n\n\n\n

<\/div>\n\n\n\n

Le contexte de cet exemple est tr\u00e8s simple, nous avons un utilisateur simple_user<\/span><\/strong> qui apr\u00e8s v\u00e9rification peut lancer le script example.py<\/span><\/strong> \u00e0 l’aide de sudo<\/span><\/strong> :<\/p>\n\n\n\n

<\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
<\/div>\n\n\n\n

Cependant ce n’est pas aussi facile que \u00e7a \u00e9tant donn\u00e9 que nous n’avons pas les droits d’\u00e9criture sur ce dernier !<\/p>\n\n\n\n

<\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\n\n\n\n

Mais comment faire pour bypass<\/span><\/strong> dans ce cas l\u00e0 ?<\/p>\n\n\n\n

<\/div>\n\n\n\n

Il faut regarder en d\u00e9tail notre fameux script, qui \u00e0 titre d’exemple importe le module random<\/strong> et g\u00e9n\u00e8re une liste de nombre entre 10 et 30 et nous l’affiche :<\/p>\n\n\n\n

<\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
<\/div>\n\n\n\n

La m\u00e9thode de cet article repose sur le fait que nous allons pouvoir \u00e9crire notre propre module random<\/strong> mais qui sera bien s\u00fbr malicieux et nous permettra donc de passer root.<\/p>\n\n\n\n

\n\n\n\n

En effet, en cr\u00e9ant un fichier random.py<\/span><\/strong> dans le chemin \/home\/simple_user\/<\/span><\/strong> python va prioriser l’ex\u00e9cution de ce module \u00e0 la place du chemin habituel que l’on peut retrouver avec la commande :<\/p>\n\n\n\n

python3 -c 'import sys; print("\\n".join(sys.path))'<\/code><\/pre>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
<\/div>\n\n\n\n
\n\n\n\n
C’est donc parti pour la cr\u00e9ation de notre \u00ab\u00a0module\u00a0\u00bb dans \/home\/simple_user\/<\/span><\/strong> :<\/p>\n\n\n\n
<\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
Une fois le module os import\u00e9 nous mettons le bit SUID<\/span><\/strong> sur le binaire bash<\/strong>.<\/p>\n\n\n\n
\n\n\n\n
Il est d\u00e9sormais temps d’ex\u00e9cuter le script afin qu’il fasse appel \u00e0 notre module :<\/p>\n\n\n\n
sudo \/usr\/bin\/python3 \/home\/simple_user\/example.py<\/code><\/pre>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
\n\n\n\n
<\/div>\n\n\n\n
Apr\u00e8s v\u00e9rification du fichier \/bin\/bash<\/strong> nous pouvons voir la r\u00e9ussite du processus !<\/p>\n\n\n\n
<\/div>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
<\/div>\n\n\n\n
Il suffit \u00e0 pr\u00e9sent d’ex\u00e9cuter la commande :<\/p>\n\n\n\n
\/bin\/bash -p<\/code><\/pre>\n\n\n\n
\"\"<\/figure><\/div>\n\n\n\n
<\/div>\n","protected":false},"excerpt":{"rendered":"
<\/span>  3<\/span> min read<\/span><\/span>Linux Privilege Escalation with Python Library Hijacking.<\/p>\n
Python will prioritize the execution of our malicious module instead of the usual path Continuer la lecture →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":1516,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false,"footnotes":""},"categories":[4,3],"tags":[21,5,9,45,15],"class_list":["post-1513","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-infosec","category-system","tag-ctf","tag-infosec","tag-linux","tag-pentest","tag-python"],"aioseo_notices":[],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/posts\/1513","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/comments?post=1513"}],"version-history":[{"count":0,"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/posts\/1513\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/media\/1516"}],"wp:attachment":[{"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/media?parent=1513"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/categories?post=1513"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/tags?post=1513"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}