Lame
Authenticated SMB Reverse shell - Distccd v1 exploitation - Kernel 2.6 udev PrivEsc
Scanning
FTP Enumeration
Not vulnerable !
SMB Enumeration & Exploitation
WRITE access is enabled !
We can get a shell using this command - Only if we are an authenticated user !
Alternative Method
Distcc v1 is vulnerable !
We can start a listener !
Privilege Escalation
We’ll need to escalate privileges. Google the OS version — Linux 2.6.24 to see if it is vulnerable to any exploits. I tried CVE 2016–5195 and CVE 2008–0600, but they didn’t work.
Let’s try CVE 2009–1185
To run it
We need to do two things:
Figure out the PID of the udevd netlink socket
Create a run file in /tmp and add a reverse shell to it. Since any payload in that file will run as root, we’ll get a privileged reverse shell
Start the listener and run the exploit with the PID
Last updated