7 ms·
Traitor: Linux privilege escalation made easy
- Deukhoofd 6y agoLooks interesting for testing local server security. A useful feature to add might be a link to an explanation of the exploited vulnerability, and how to resolve it.
- tyingq 6y agoSounds like a good suggestion. In the meantime... It looks like there's basically 2 types of local privilege exploits used. https://github.com/liamg/traitor/tree/main/pkg/exploits https://github.com/liamg/traitor/tree/main/pkg/exploits 1) Writeable Docker Socket: https://www.exploit-db.com/exploits/42356 https://www.exploit-db.com/exploits/42356 2) GTFObins: https://gtfobins.github.io/ https://gtfobins.github.io/
- larpnet 6y agoHow do you plan to use this universally across compromised systems, if they don't have Go to compile this? A better solution might be https://github.com/Frissi0n/GTFONow https://github.com/Frissi0n/GTFONow which is written in python without dependencies and supports Py2/3. I would expect this to work on more hosts.
- gpm 6y agoYou ship binaries not source code.
- seniorivn 6y agoyou can always ship compiler with source code
- dbrgn 6y agoThat is... not wrong.
- userbinator 6y ago...also known as an interpreter.
- dbrgn 6y agoI'm confused. Why should you need Go on the target system? Go generates a static binary, that runs anywhere as long as the architecture matches.
- sharpnet 6y agoResponding here under a new account since due to being banned for all the downvotes. People here are viewing this with their developer hat on, download a static binary? Sure what’s the issue? For people who work in security will know that you encounter systems with all sorts of architectures and operating systems. As a pentester do you want to keep 14 different binaries for each security tool you have so that you are prepared for all platforms and architectures? As a CTF player do you want to afford the time to compile this for whatever platform you encounter? That’s why tools like linenum.sh and linpeas.sh are written in bash. They run on anything.
- 0x003 6y agoI mean typically yes, I keep binaries around for whatever system I'm targeting. 32+64bit binaries for linux and windows (4 total) will cover about 99% of any machines you're likely to come across. I think you've taken more of an issue with this than is necessary, seeing as if I can run linpeas or linenum I am probably not going to have an issue running a static binary, and it's really a matter of personal choice.
- SXX 6y agoUnlike most of compiled languages Go have no-effort cross-compile for different architecture. All you need is to specify GOARCH. So what's problem with compiling different binaries?
- FDSGSG 6y ago>That’s why tools like linenum.sh and linpeas.sh are written in bash. I've encountered many systems without bash.
- mindwok 6y agoThere's no way to achieve this...even writing things in POSIX is going to be incompatible on some systems. Having a different binary for different systems is necessary. Even writing things in an interpreted language e.g. Python still requires at least Python binaries on all your systems, and that's ignoring dependencies. It doesn't get much more convenient than Golang's cross compilation.
- iso1631 6y agoWell that failed rather misterably package github.com/liamg/traitor/cmd/traitor: mkdir /home/test/go: not a directory Does go assume that you have a directory in $HOME that is for it's own personal use?
- axaxs 6y agoYes, that's precisely what it does.
- Filligree 6y agoAnd good luck making it fit in a multi-language project of any kind.
- smokey_circles 6y agowell, no. that's just default behavior. and it's also just for depedencies it downloads. _your_ code lives where you put it
- Filligree 6y agoI spent days, a few years ago, trying to figure out how to do that. When I asked on the IRC channel, they just made fun of me. Perhaps that's changed, but it put me off the language entirely.
- axaxs 6y agoNot just you. I've been using Go for many years, and while I enjoy the language I always found the environment of it awkward and unfriendly. Envvars on top of envvars. Work only in GOPATH, no wait, stop working in GOPATH. Vendor things...no wait don't do that either. I think a lot of it is just growing pains, but it still feels clunky. My system has a .cache folder that everything already uses, why does Go need a special cache?
- 6y ago
- guenthert 6y agoFrom the readme (saves you the trip to github): "It'll exploit most sudo privileges listed in GTFOBins to pop a root shell, as well as exploiting issues like a writable docker.sock. More routes to root will be added over time too."
- 0x003 6y agoIt's a cool idea and I like the execution but if I'm at the point where I've uploaded the binary over and executed it I've already run `sudo -l` and checked my permissions (and I could be wrong but from my brief scan of the source code I don't think it attempts to exploit SUID but just sudo permissions). Probably would save a little bit of time with docker escalation but again pretty standard enumeration would've revealed that vector by then.
- easterncalculus 6y agoSeems interesting with the Docker exploit I guess. I would still recommend linpeas: https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS https://github.com/carlospolop/privilege-escalation-awesome-... Most of these tricks are listed here at GTFOBins: https://gtfobins.github.io/ https://gtfobins.github.io/ which is based on LOLBAS for Windows: https://lolbas-project.github.io/# https://lolbas-project.github.io/#