search
Read BlogpostsLet's Connect

linuxNibbles

SUID misconfiguration in `find` binary led to privEsc

hashtag
Summary

  • PostgreSQL running on non-standard port 5437 with unauthenticated access.

  • SQL enumeration revealed usernames and allowed RCE via command injection (CVE-2022-2625).

  • Reverse shell established as postgres.

  • Privilege escalation via SUID misconfiguration using find binary to get a root shell.

hashtag
🧵 Let's Unpack

hashtag
🔍 Enumeration

sudo nmap -A -T4 -sC -sN -oN nmapFull -p 21,22,80,139,445,5437 192.168.197.47

  • 5437/tcp → PostgreSQL 11.3

  • 21/ftp → Anonymous login allowed but no file listing

  • 80/http → Apache/2.4.38 with default landing page

  • 139/445 → SMB open but filtered

hashtag
🐘 PostgreSQL Enumeration & Exploitation


# connecting with default password
psql -h 192.168.197.47 -p 5437 -U postgres

# Commands
\list # list db
\c <database> # use the db
\d # list tables
\du # get user roles

SELECT user # get current user

# Get current database
SELECT current_catalog;

# List schemas
SELECT schema_name,schema_owner FROM information_schema.schemata;
\dn+

#List databases
SELECT datname FROM pg_database;

#Read credentials (usernames + pwd hash)
SELECT usename, passwd from pg_shadow;

# Get languages
SELECT lanname,lanacl FROM pg_language;

# Show installed extensions
SHOW rds.extensions;
SELECT * FROM pg_extension;

# Get history of commands executed
\s

Found valid users:

  • postgres, root, wilson

Used Exploit-DB 50847arrow-up-right for command injection.

Exploit Chain:

  • Reverse shell established as user: postgres

  • Upgraded with:

hashtag
Privilege Escalation

  • Ran linpeas.sh, which revealed:

    • Apache running as root

    • Interesting cron jobs and SUID binaries

    • /usr/bin/find has SUID bit set

chevron-rightLinpeas resultshashtag

Used find SUID trick to escalate:

✅ Root shell achieved.

PreviousBratarinaNextHetemit

Last updated