1

Background

In practicing pentesting a VM on Vulnhub I encountered an issue that is quite interesting with Brainpan. After initial access with a limited shell generated from a BoF exploit on a service running on port 9999, I did some basic enumeration and found the following :

  1. sudo -l revealed that the current shell user (puck) can run a program anansi_util owned by another user (anansi) as root, a simple ls -l <program> found that I only have executable and read perm on that file, and not write perm.
  2. find / -perm -4000 -type f revealed another program validate within the /usr/local/bin directory owned by the other user (anansi), and this program has the SUID bit set. (which should mean the program's forked child processes should inherit the parent program's uid as euid) puck also has read and executable perm on validate.

So I decided to explore finding #2 and try to exploit the SUID set program with another BoF. The shellcode I generated was from msfvenom and it was a linux/x86/exec payload and option CMD=bash. I was able to exec another bash prompt after successfully exploiting the BoF issue the program had.

Issue

The bash program forked from validate did not give itself the euid of anansi, who owns the program/file validate inside the usr/bin/local directory , and the process still belonged to puck with no euid when I execute id

Question

Is this expected behavior? I always thought that if we fork a process from a parent process who's SUID bit is set, that the child process will inherit the parent process's uid as euid, isn't that what sudo does?

0x5929
  • 335
  • 4
  • 13
  • @SteffenUllrich thank you, I didn’t see the link until now. Basically it says that bash like other shells will drop priv during start up. I will try to get a python interpreter instead and have that spawn bash, see if that’ll work as a workaround. – 0x5929 Oct 09 '20 at 18:06
  • @SteffenUllrich invoking /bin/sh would work in this VM. – 0x5929 Oct 09 '20 at 19:35
  • @Rennitbaby you may be able to try `/bin/sh -p` to retain the EUID of the file's owner. – multithr3at3d Oct 12 '20 at 04:57

0 Answers0