GTFOBins

https://gtfobins.github.io/

by matthberg • 5 years ago

324 54 5 years ago

gtfobins.github.io

bawolff2• 5 years ago

Kind of weird to list every program that reads an input file with higher privleges under sudo or suid. That's like almost every program, and kind of the entire point of sudo/suid.

creshal5• 5 years ago

You still need to make sure that these programs are set up such that they don't accidentally allow more access than you expected them to.

turminal• 5 years ago

This list is completely useless to someone that doesn't know base64 reads files.

salicideblock• 5 years ago

There is a feature of sudo to allow only certain user/command combinations. E.g. User M can only run "apt" under sudo.

The site explains how User M can exploit such situations to bypass this restriction. User M can thus effectively run anything under sudo.

darkwater• 5 years ago

But with sudo you can specify which parameters are allowed for that binary (or the whole command line). But TBH IDK if this applies to I/O redirections as well.

matthberg3• 5 years ago

True, yet in a few cases the not-dropping of privileges is a real risk, like with `less` [0], which allows for arbitrary shell access despite being meant for for just paging. Also, it's useful to know that a program is sloppy with permissions in case any bugs are found in it; a CS prof I once had always insisted we dropped permissions and capabilities as soon as we were done with them so that any calls to other libraries or our own buggy code could do the least damage possible, just like how it's good practice to not run every command as root.

[0] https://gtfobins.github.io/gtfobins/less/

JohnFen• 5 years ago

a CS prof I once had always insisted we dropped permissions and capabilities as soon as we were done with them

Only once?? Doing this should be muscle memory for working devs.

idorosen3• 5 years ago

You are viewing the list from a position of great privilege, due to your greater knowledge. Many devs don’t understand how sudo or setuid binaries even work, some may not even know that sudo itself is a setuid binary. Asking interview questions like “how does sudo work” yields interesting results ranging from “magic/witchcraft” to “it’s part of the Linux kernel”, even in some very senior engineers. As an educational/training tool, including at least one example of the unintended consequences of ill-formed sudo configurations and setuid binaries in GTFOBins makes sense to me.

Heck, IMO, we shouldn’t have a single role with all the privileges, opting instead for a capabilities-like system with specific admin roles for different domains of control. There are other *nixes where this was the case historically.

fragmede2• 5 years ago

Linux has capabilities(7), as I'm sure you know, but security is complicated, and the practical thing to do is still to turn off selinux and apparmor if you're running into weird problems. There are absolutely use cases for them, but "complicated" is a bug, not a feature.

sokoloff• 5 years ago

You are viewing the list from a position of great privilege

  sudo lynx --dump https://gtfobins.github.io/ | grep https://gtfobins | tail +3 | grep -v # | sed 's/^.*\/\(.*\)\/$/\1/' | sudo less

bawolff2• 5 years ago

You don't need to understand how sudo works to know what it does. If you didn't know that running `sudo cat someFile` will leak the contents of the file, then this list is at the wrong level, and probably won't help you.

I'm not hating on people for not knowing things - it just seems like either its already obvious and this won't help you or its not obvious and it still won't help you because its not really teaching you the right thing. Either way, it seems kind of silly.

JeremyNT• 5 years ago

Indeed, if you trust somebody enough with a login on your system, you presumably have an expectation of some kind of good faith. If you further grant them sudo to run binaries like these with arbitrary args, that implies some even greater level of trust, and that user presumably understands the social contract at play. They should know to abide by the intent of the sudo restriction (rather than trying to work around it with clever invocations).

I was a sysadmin in a former life, and I didn't usually expect 'sudo' to provide a thorough technical defense against a user intent on wreaking havoc. As typically configured, with blanket access to one or more tools that allow arbitrary file manipulation, it's more like a subtle nudge than a real guardrail. You hope and assume the user respects you and their access level in a way such that they don't work around obvious intent.

It's of course possible to limit the use of 'sudo' carefully (i.e., restrict it to invoking wrapper scripts around specific functions which accept minimal user input) but it's often not expedient to do so, and often expedience rules the day.

mettamage3• 5 years ago

When I played hackthebox.eu I made extensive use of this :D

And that's when you realize how many websites there are out there that make simple attacks so much easier.

thih9• 5 years ago

I never heard about Hackthebox; do you recommend it? What is their business model?

mettamage3• 5 years ago

Their business model is simple:

* You can hack free boxes and get a mediocre VPN connection to their boxes (that are playable as free). It's doable, but I got annoyed by certain things.

* You can get a subscription for (I forgot) like ... 10$ per month? And then you get a good VPN connection to an entirely different set of servers. It also opens up many more boxes to hack!

matthberg3• 5 years ago

Also if you haven't already, check out some of the OverTheWire wargames [0]. I sure wish I had found this site before trying some of them.

[0] https://overthewire.org/wargames/

mettamage3• 5 years ago

Sounds like fun! I don't have the copious amount of time I had when I did hackthebox, but when I feel the need to hack, I'll check it out. Thanks!

kiryin• 5 years ago

If the binary is allowed to run as superuser by sudo, it does not drop the elevated privileges and may be used to access the file system, escalate or maintain privileged access.

Wat. If you add someone to wheel, they may abuse those privileges. Is this really something that needs pointing out? There are many other useful tidbits that you may not necessarily know but this one struck me as a bit odd.

creshal5• 5 years ago

You're kind of missing the point of sudo if that's all you use it for. sudo can also be used to whitelist specific user+program+argument combinations, so e.g. unprivileged users can run system updates, but not install new programs. These users can use sudo, but should not be able to reach full root privileges from it.

But if such a setup is indirectly exploitable because the default $PAGER allows arbitrary code execution, that's definitely a gotcha you need to be aware of.

NavinF6• 5 years ago

I remember reading about this use case ~10 years ago. I always found it super weird and I've never had a chance to use it. Even back then, people didn't share computers unless they fully trusted each other.

If a program running as an unprivileged user wants to trigger something like a software update, I'd just write a daemon that reads the trigger command over a unix socket or a signed message over a TCP socket and then runs the update. I guess you'd lose the automatic audit logging of sudo, but pretty much any programmer can verify correctness.

scandinavian• 5 years ago

It's not referring to having sudo ALL permissions, but to users having sudo permissions for individual applications.

So if you are trying to privilege escalate a linux box and sudo -l returns:

(root) /usr/sbin/tcpdump

You check gtfobins for tcpdump and see that you can get a root shell with sudo access.

pjmlp4• 5 years ago

If the server admin was dumb enough to allow executables on $HOME, or anywhere where the user has write access.

matthberg3• 5 years ago

I also found this a bit overly obvious at first, yet when considering it from an unintended side effects/uses perspective it's actually a valid thing to consider. For example, `less`[0] might be used with `sudo` to view a file owned by another user. This is all good until you remember that you can run arbitrary commands by just hitting '!' in the paging view, which are also runs with `sudo` privileges. Though that might seem like a bit of a contrived example, through unintended features otherwise safe tools can be unexpectedly dangerous (the entire point of this site).

For a real-ish world example of this effect, one of the OverTheWire wargame challenges [1] (spoilers for bandit) has a user login "shell" be a message saying login was prohibited, printed with `less`. When you resize your console window to a point where scrolling is needed and then attempt login, you can then interact with `less` and use '!' to run commands as the current user and print the key. Now you may say this isn't relevant to the `sudo` category of risk since who runs `sudo less` without also being able to run `sudo anything`, but many other apps use less as their pager, and some of those make much more sense to allow for general use with sudo (like say allowing all users to update apps, or any of hundreds of other insignificant things).

In short, I think the `sudo` and `setuid` notices might be better considered as "permission transparent", i.e. any permissions or access you hand to the listed tools are handed directly to the user as well. There are secure ways to not do this when writing programs, like by setting all of the real, effective, and saved uids [2] to something non-root (or the original calling user, if available) and totally wiping the capabilities sets before `exec()`ing anything, yet that's just what I remember from a computer security class a few years ago, you would probably be best off looking into it further if you're writing anything security sensitive.

[0] https://gtfobins.github.io/gtfobins/less/

[1] https://overthewire.org/wargames/bandit/

[2] https://man7.org/linux/man-pages/man2/setresuid.2.html

VBprogrammer• 5 years ago

I used to work for a company where launching a shell from within vim was the way we got privileged access on some of the customers boxes (which ran code we developed). Pretty crazy looking back on it..

cygnus-xr1• 5 years ago

Preparing for the OSCP exam I make extensive use of GTFOBins.

Also LOLBAS (Living Off The Land Binaries and Scripts (and also Libraries)

:) https://lolbas-project.github.io/#

Retr0id2• 5 years ago

A lesser known trick, which is not listed here, is that you can use dd to get arbitrary code execution by writing to /proc/<pid>/mem.

thricegr8• 5 years ago

Woah - can you expand on this a bit? I don't have a system to test atm, but I'm curious how that works. Are you sure privileges/security boundaries are circumvented?

Retr0id2• 5 years ago

If YAMA is disabled, you can use it to migrate laterally into processes owned by the same user. See [1].

It only really crosses a security boundary if, for some reason, dd is configured to run as root (e.g. via setuid bit, or sudo config). At that point, you could use it to patch the filesystem directly anyway, but keeping things in-memory is much stealthier (and less risk of bricking hardware, if your working with an embedded device or similar).

For a description of using dd to gain file-less native code execution, see [2].

As a concise (golfed) example (x86-64 /bin/sh shellcode):

    cd /*/$$;read a<*l;exec 3>mem;base64 -d<<<McBIu9GdlpHQjJf/SPfbU1RfmVJXVF6wOw8F|dd bs=1 seek=$[`cut -d\  -f9<<<$a`]>&3

Source: [3]

[1] https://www.kernel.org/doc/Documentation/security/Yama.txt

[2] https://blog.sektor7.net/#!res/2018/pure-in-memory-linux.md

[3] https://twitter.com/David3141593/status/1386678449604108289

ltbarcly3• 5 years ago

the answer is all of them. This website can be replaced by `ls /**/*bin`. any program which does anything nontrivial that you call with sudo is going to let you do something with root privileges you couldn't otherwise do.

anthk3• 5 years ago

Also, from nethack, too. If your build has set to read mail, you can fire up the mail reader by reading an ingame scroll (I am not kidding), and then spawning a shell from mail(1)/nail(1) or mutt with urlview it's really easy.

GTFOBins

Related Stories