Traitor: Linux privilege escalation made easy

by draugadrotten • 5 years ago

281 38 5 years ago

Deukhoofd• 5 years ago

Looks interesting for testing local server security. A useful feature to add might be a link to an explanation of the exploited vulnerability, and how to resolve it.

tyingq• 5 years ago

Sounds like a good suggestion. In the meantime...

It looks like there's basically 2 types of local privilege exploits used.

https://github.com/liamg/traitor/tree/main/pkg/exploits

1) Writeable Docker Socket: https://www.exploit-db.com/exploits/42356

2) GTFObins: https://gtfobins.github.io/

larpnet• 5 years ago

How do you plan to use this universally across compromised systems, if they don't have Go to compile this?

A better solution might be https://github.com/Frissi0n/GTFONow which is written in python without dependencies and supports Py2/3. I would expect this to work on more hosts.

gpm• 5 years ago

You ship binaries not source code.

seniorivn• 5 years ago

you can always ship compiler with source code

dbrgn2• 5 years ago

I'm confused. Why should you need Go on the target system? Go generates a static binary, that runs anywhere as long as the architecture matches.

sharpnet• 5 years ago

Responding here under a new account since due to being banned for all the downvotes.

People here are viewing this with their developer hat on, download a static binary? Sure what’s the issue?

For people who work in security will know that you encounter systems with all sorts of architectures and operating systems.

As a pentester do you want to keep 14 different binaries for each security tool you have so that you are prepared for all platforms and architectures?

As a CTF player do you want to afford the time to compile this for whatever platform you encounter?

That’s why tools like linenum.sh and linpeas.sh are written in bash.

They run on anything.

iso16312• 5 years ago

Well that failed rather misterably

  package github.com/liamg/traitor/cmd/traitor: mkdir /home/test/go: not a directory

Does go assume that you have a directory in $HOME that is for it's own personal use?

axaxs2• 5 years ago

Yes, that's precisely what it does.

Filligree2• 5 years ago

And good luck making it fit in a multi-language project of any kind.

oauea2• 5 years ago

Not since 2019: https://blog.golang.org/using-go-modules

The project has to opt into it, which appears to be the case here since there is a `go.mod` file. Are you using a modern version of Go?

axaxs2• 5 years ago

If you opt into modules, modules get stored in GOPATH. If you don't use modules...source gets downloaded into GOPATH. If GOPATH is unset, it uses ~/go.

tsimionescu2• 5 years ago

Actually, modules are still downloaded to a global location, they are not copied locally to your project by default.

spinny• 5 years ago

Go uses $GOPATH to save it's own packages/binaries but uses $HOME/go if $GOPATH is not set. Originally needed $GOPATH to be set, but that changed later

z3t4• 5 years ago

I guess if it can't write to /home/test your system is safe...

iso16312• 5 years ago

I have a file - /home/test/go, which consisted of some script I'd knocked up a few months ago

nonameiguess• 5 years ago

He obviously wasn't clear enough about this, but if you're just trying to use the tool, download the binary release. Don't use go get as an installer. They're trying to be multi-OS compatible, an autotools that doesn't assume every system has a /usr/local or whatever the Windows equivalent but not assuming everyone has a %USERPROFILE%\AppData\Local\Low\Roaming or whatever. It does assume everyone has a home directory and an environment variable indicating where that is.

guenthert• 5 years ago

From the readme (saves you the trip to github): "It'll exploit most sudo privileges listed in GTFOBins to pop a root shell, as well as exploiting issues like a writable docker.sock. More routes to root will be added over time too."

0x0032• 5 years ago

It's a cool idea and I like the execution but if I'm at the point where I've uploaded the binary over and executed it I've already run `sudo -l` and checked my permissions (and I could be wrong but from my brief scan of the source code I don't think it attempts to exploit SUID but just sudo permissions). Probably would save a little bit of time with docker escalation but again pretty standard enumeration would've revealed that vector by then.

easterncalculus• 5 years ago

Seems interesting with the Docker exploit I guess. I would still recommend linpeas: https://github.com/carlospolop/privilege-escalation-awesome-...

Most of these tricks are listed here at GTFOBins: https://gtfobins.github.io/ which is based on LOLBAS for Windows: https://lolbas-project.github.io/#

Traitor: Linux privilege escalation made easy

Related Stories