Closing Linux privilege escalation paths: SUID, sudo, cron
Auditing SUID, sudo, cron and sensitive files, and detecting escalation attempts.
Level 301 · 17 lessons · 15 practice labs
Lessons
Map and audit
- A map of privilege escalation paths: You will get an overview of the ways a user's privileges can rise on Linux and build your audit checklist from it.
- Auditing your own server: automated audit tools: You will run automated audit tools on your own server, interpret their output and decide what needs fixing.
- Short task: run an automated audit on the lab server and classify the findings
File and privilege paths
- Auditing SUID files: You will learn what SUID files mean, then find and clean up the unnecessary or risky ones on your own server.
- Auditing file capabilities with getcap: You will use getcap to find programs that carry extra privileges without SUID and remove the capabilities they do not need.
- Auditing and narrowing sudo rules: You will read sudo rules, find the ones broader than needed and narrow the rights down to only the commands required.
- Permissions of cron jobs and root scripts: You will check the file permissions of cron jobs and root scripts and fix any that ordinary users can change.
- Writable systemd units and PATH order: overlooked paths: You will find cases where service files and scripts that run as root can be changed by others, and fix their permissions.
- Short task: close three escalation paths and verify they are closed
Information leaks
- Sensitive files and configuration leaks: You will find and close wrong permissions and leaked information in sensitive files such as backups, config files and keys.
- Credentials forgotten in shell history: You will find and clean passwords and keys forgotten in shell history and scripts, and learn how to stop it happening again.
- Protecting /etc/passwd and /etc/shadow: You will learn what /etc/passwd and /etc/shadow hold, what their correct permissions are, and how to monitor changes to them.
- Shared library paths and writable directories
- Short task: find and remove credentials forgotten on the server
Patching and detection
- Tracking kernel versions and patching local escalation flaws: You will match a server’s kernel version against known advisories, plan the patch and verify it after a reboot.
- Detecting escalation attempts: You will catch unexpected privilege changes in logs and audit records and set up alert rules for them.
- Capstone: close the escalation paths on a server: In the capstone you will find and close the privilege escalation paths on a fictional company's Linux server and report what you did.
Practice labs
- Run an automated audit and classify findings: Sort the local audit script's output into file, privilege, leak and patch categories.
- Map the privilege escalation paths on the server: Place each weak point on a path from the starting user to root and rank them.
- Weed out findings the automated audit overstated: Verify five findings by hand, separate real paths from false alarms and report the reasons.
- Find the extra SUID file that grants privilege and remove its bit: Find the non-default SUID file, remove the bit and confirm it no longer grants privilege.
- Audit file capabilities and remove the unneeded one: Find the risky capability in getcap output, remove it and check the program still works.
- Close three escalation paths and verify they are closed: Fix three paths from SUID, capabilities and sudo, rerun the audit and fill the before-and-after table.
- Audit permissions of cron scripts run by root: List scripts called by root's cron entries and fix any writable by others.
- Fix writable systemd units and PATH order: Find writable unit files and a writable directory in root's PATH, fix the permissions and verify.
- Close writable directories in shared library paths: Find the writable directory in the library search path config, remove it and check services load the right libraries.
- Find and remove credentials left in shell history: Find commands with passwords in history files, clean them and change the affected password.
- Find secrets in readable configuration files: Find passwords and keys readable by everyone in app directories, tighten permissions and rotate the secret.
- Audit protection of the passwd and shadow files: Find a mis-permissioned shadow backup and a passwd line holding a hash, fix them and verify integrity.
- Track the kernel version and patch local escalation issues: Compare the running kernel with advisories, install the current kernel and confirm the version after reboot.
- Set up rules that detect privilege escalation attempts: Add monitoring rules for SUID changes and unexpected root processes, generate a test event and find the record.
- Close every escalation path on a server and report: Complete audit, fix, detection and re-audit on Yelkovan Bankası's lab server and write the report.
About this course
Auditing SUID, sudo, cron and sensitive files, and detecting escalation attempts.
What you will learn
- Map and audit
- File and privilege paths
- Information leaks
- Patching and detection
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.