there is a new exploit for Linux a lot
of exploits been happening as Linux has
become a bit more popular and well it's
pretty interesting to see some of these
instead of showing you some article
saying this is the exploit I like to
pull up an old Linux instance show you
the exploit in action update that
instance and see if the exploit is still
happening uh this specific exploit is um
basically to where you can elevate your
user to rout and delete the whole system
if you want it so like let's say I
wanted to delete delete the root
folder you know like this and just do
like a recursive Force it's going to say
permission denied because well I don't
have permissions to remove the root
folder because I'm not root uh however
we can Elevate this I'm using Centos 7
for this because it was a pretty big in
production you should obviously not be
using Centos anymore use go to like Alma
or rocky Linux if uh you're using a rail
BAS system but also update your system
I've already tried this exploit in the
latest version of arch and also the
latest version of Ubuntu and both uh
basically failed which is good but I
want to show you a success story so
we're using an older version of Linux uh
we're going to first just do a WG and
grab our script to basically hack into
Linux and we're going to do this with
hacks doin uh files and then I think it
was blasty verse p
p exec. c now this is a a c file and I'm
just going to cat that just to make sure
I got the right one oh it actually did
not grab it because of the
certificate all right now let's cat
blasty and you'll see this is just a c
program so let's uh compile this we use
GCC so far the only two dependencies we
have are pretty much on every Linux
system out there uh most Linux systems
have uh PK exec which is what we're
going to exploit uh they have WG to grab
stuff from the internet and they have
GCC to compile C program so we're going
to do GCC uh blast
dc- o for output and then we'll just
call this make me root and then if we do
all listing you'll see make me root and
we'll just run
that oh boy oh boy look at that we are
now rout in our little user home but
let's try and go to the root directory
can we do stuff let's uh just make a
file blow up
system
LS oh boy so we just elevated without
any pseudo without anything into the
root user and from that root prompt we
can just have fun with this system now
mind you this is a a local elevation
exploit meaning you have to be logged
into the system so it's not as bad as
like a lot of Windows executables or or
exploits where people will do remote
execution which is extremely vulnerable
that's why a lot of Windows stuff is uh
as a hacker it would be much more
appealing to go after Windows systems
because uh I haven't really seen too
many remote executables actually I don't
know if I've ever seen one in a Linux
system so that just a quick explanation
so let's uh let's change this let's
update our system we're going to go
ahead and at this we'll clear it out and
we're just going to do a pseudo yum
update and we'll do that with a uh yes
and what this is going to do is it's
going to grab the latest version of
everything update the cintos 7 system
and let's just see if this is any better
than what it is now all right it looks
like we finally got our system update it
took a couple minutes and we're just
going to do a reboot and uh see what
happens on our reboot looks like we got
a new kernel
um some new firmware more up-to-date
packages uh so let's install that we're
in the
hacker um and let's take a look here
first let's just try and do make me root
see what happens ah look at that cool so
it did patch that uh if we do PK exec I
think that was an older version of PK
exec and if we do das Das version yeah
this is 0.11 too uh I know on Arch it's
a little bit different so obviously
patch your systems is what this is
telling me uh and let's let's change
this up a little bit more and from here
let's go ahead and I want to just show
you my system here and uh we can do the
same thing I've actually think I've
already downloaded uh make me root and
did all that let's just remove that and
I'll just grab that blasty a
GCC blasty DC output that to
root um and let's just say
root and yeah does the same thing um and
it will just deny you that in the PK
exec on this one Das Das version you'll
see is uh
one1 120 which is a little bit different
from our Centos version but it's good to
see this actually patched and I've
actually uh run this a couple times with
uh different scenarios I did a
blanket Ubuntu Server installed just to
see what would happen and Ubuntu Server
now basically bakes in security patches
directly into their installer and you
can't even cancel the updates to it
because I tried to install it on a buntu
and it just wouldn't let me do it in
Native form now obviously if I had an
old version of auntu already spun up
that was offline or not getting updates
I could still run this exploit and do it
but it's just nice to see that uh the
Linux Community is always so far ahead
of this and I I think at one time I
bashed a security researcher and for
that I apologize but it's really nice to
see these security researchers putting
this stuff out here so we can try it but
it also tells you how important updates
are because you can actually take this
stuff from these security researchers
try it out on your system and then you
can see the vulnerability yourself you
don't have to take your advice from some
internet personality on YouTube you can
actually try it and then figure it out
yourself so this is kind of a cool
little exploit uh definitely Tred on
some systems make sure you're patched uh
run your updat says uh you probably hear
so often but this is why you run your
updates as uh you could see but from my
example but with all that said let me
know your thoughts down in the comment
section and I'll see you in the next one