Kernel version: 3.2.0 Architecture: x86_64 Distribution: debian Distribution version: 7 Additional checks (CONFIG_*, sysctl entries, custom Bash commands): performed Package listing: from current OS
Details: https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.html Exposure: less probable Tags: ubuntu=16.04{kernel:4.8.0-(34|36|39|41|42|44|45)-generic} Download URL: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2017-7308/poc.c ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2017-7308/poc.c Comments: CAP_NET_RAW cap or CONFIG_USER_NS=y needed. Modified version at 'ext-url' adds support for additional kernels
[+] [CVE-2017-6074] dccp
Details: http://www.openwall.com/lists/oss-security/2017/02/22/3 Exposure: less probable Tags: ubuntu=(14.04|16.04){kernel:4.4.0-62-generic} Download URL: https://www.exploit-db.com/download/41458 Comments: Requires Kernel be built with CONFIG_IP_DCCP enabled. Includes partial SMEP/SMAP bypass
Details: https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt Exposure: less probable Tags: debian=7.7|8.5|9.0,ubuntu=14.04.2|16.04.2|17.04,fedora=22|25,centos=7.3.1611 Download URL: https://www.qualys.com/2017/06/19/stack-clash/linux_ldso_hwcap_64.c Comments: Uses "Stack Clash" technique, works against most SUID-root binaries
[+] [CVE-2017-1000253] PIE_stack_corruption
Details: https://www.qualys.com/2017/09/26/linux-pie-cve-2017-1000253/cve-2017-1000253.txt Exposure: less probable Tags: RHEL=6,RHEL=7{kernel:3.10.0-514.21.2|3.10.0-514.26.1} Download URL: https://www.qualys.com/2017/09/26/linux-pie-cve-2017-1000253/cve-2017-1000253.c
Details: https://legalhackers.com/advisories/MySQL-Maria-Percona-PrivEscRace-CVE-2016-6663-5616-Exploit.html Exposure: less probable Tags: ubuntu=16.04.1 Download URL: http://legalhackers.com/exploits/CVE-2016-6663/mysql-privesc-race.c Comments: Also MariaDB ver<10.1.18 and ver<10.0.28 affected
[+] [CVE-2016-2384] usb-midi
Details: https://xairy.github.io/blog/2016/cve-2016-2384 Exposure: less probable Tags: ubuntu=14.04,fedora=22 Download URL: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2016-2384/poc.c Comments: Requires ability to plug in a malicious USB device and to execute a malicious binary as a non-privileged user
[+] [CVE-2015-9322] BadIRET
Details: http://labs.bromium.com/2015/02/02/exploiting-badiret-vulnerability-cve-2014-9322-linux-kernel-privilege-escalation/ Exposure: less probable Tags: RHEL<=7,fedora=20 Download URL: http://site.pi3.com.pl/exp/p_cve-2014-9322.tar.gz
[+] [CVE-2015-8660] overlayfs (ovl_setattr)
Details: http://www.halfdog.net/Security/2015/UserNamespaceOverlayfsSetuidWriteExec/ Exposure: less probable Tags: ubuntu=(14.04|15.10){kernel:4.2.0-(18|19|20|21|22)-generic} Download URL: https://www.exploit-db.com/download/39166
[+] [CVE-2015-8660] overlayfs (ovl_setattr)
Details: http://www.halfdog.net/Security/2015/UserNamespaceOverlayfsSetuidWriteExec/ Exposure: less probable Download URL: https://www.exploit-db.com/download/39230
[+] [CVE-2014-5207] fuse_suid
Details: https://www.exploit-db.com/exploits/34923/ Exposure: less probable Download URL: https://www.exploit-db.com/download/34923
[+] [CVE-2014-4699] ptrace/sysret
Details: http://www.openwall.com/lists/oss-security/2014/07/08/16 Exposure: less probable Tags: ubuntu=12.04 Download URL: https://www.exploit-db.com/download/34134
[+] [CVE-2014-4014] inode_capable
Details: http://www.openwall.com/lists/oss-security/2014/06/10/4 Exposure: less probable Tags: ubuntu=12.04 Download URL: https://www.exploit-db.com/download/33824
[+] [CVE-2014-0196] rawmodePTY
Details: http://blog.includesecurity.com/2014/06/exploit-walkthrough-cve-2014-0196-pty-kernel-race-condition.html Exposure: less probable Download URL: https://www.exploit-db.com/download/33516
[+] [CVE-2013-2094] semtex
Details: http://timetobleed.com/a-closer-look-at-a-recent-privilege-escalation-bug-in-linux-cve-2013-2094/ Exposure: less probable Tags: RHEL=6 Download URL: https://www.exploit-db.com/download/25444
[+] [CVE-2013-2094] perf_swevent 2
Details: http://timetobleed.com/a-closer-look-at-a-recent-privilege-escalation-bug-in-linux-cve-2013-2094/ Exposure: less probable Tags: ubuntu=12.04{kernel:3.(2|5).0-(23|29)-generic} Download URL: https://cyseclabs.com/exploits/vnik_v1.c Comments: No SMEP/SMAP bypass
[+] [CVE-2013-1959] userns_root_sploit
Details: http://www.openwall.com/lists/oss-security/2013/04/29/1 Exposure: less probable Download URL: https://www.exploit-db.com/download/25450
[+] [CVE-2013-0268] msr
Details: https://www.exploit-db.com/exploits/27297/ Exposure: less probable Download URL: https://www.exploit-db.com/download/27297
看了一下 不好提权 因为没有编译环境并且有些需要的库都没有
root:root
得到另外两个人的密码
sara:ihatethisjob
william:senseable
登陆上了sara的账户
sudo -l
cat 和ls 都可以以root的权限执行且不需要密码
但是但是只能cat ls /accounts/下的文件
