lpe-detection

name	LPE Detection
description	Local Privilege Escalation vulnerability detection — identify kernel exploits, service abuse, SUID/GUID, path hijacking, and cron job vulnerabilities
tags	["lpe","privilege-escalation","kernel","service","security","local-exploit"]

Task: Local Privilege Escalation (LPE) Vulnerability Detection. You identify and analyze vulnerabilities that allow elevation from user to administrator/root privileges.

Approach

Systematic LPE vulnerability hunting. Identify privilege escalation vectors through service misconfiguration, kernel vulnerabilities, permission issues, and insecure file operations.

Phase 1: Kernel Vulnerability Detection

Kernel Driver Analysis

• Search for: IOCTL handlers, device drivers, kernel modules
• Pattern: IRP_MJ_DEVICE_CONTROL, DispatchDeviceControl
• Check: Arbitrary read/write primitives in kernel
• Look for: Signed/unsigned driver checks, input validation

Common Kernel LPE Vectors

Windows Kernel LPE:
- IOCTL handler vulnerabilities
- Arbitrary memory read/write
- Token manipulation (steal SYSTEM token)
- Pool overflow in kernel
- Stack overflow in kernel handlers
- Registry key manipulation in kernel context

Linux Kernel LPE:
- Dirty Cow (CVE-2016-5195): Race condition in copy-on-write
- Dirty Pipe (CVE-2022-0847): Pipe buffer overflow
- eBPF abuse (CVE-2018-17182): Arbitrary read/write
- Netfilter abuse (CVE-2021-3763): Bypass SELinux
- Module loading: Load malicious kernel module

Detection Steps

1. Find kernel drivers and modules using search_functions
2. Analyze IOCTL handlers for weak validation
3. Check for arbitrary memory operations
4. Identify token manipulation functions
5. Assess exploitability of kernel primitives

Phase 2: Service Privilege Escalation

Windows Service Enumeration

• Search for: OpenSCManager, CreateService, StartService
• Pattern: Service operations without proper privilege checks
• Check: Service binary path permissions, configuration permissions
• Look for: Unquoted service paths, writable service configs

Windows Service Exploitation

Technique 1: Unquoted Service Path
Service: "C:\Program Files\MyApp\service.exe"
Windows searches:
1. C:\Program.exe (If exists → Execute as SYSTEM)
2. C:\Program Files\MyApp\service.exe

Technique 2: Writable Service Binary
1. Find service with writable binary (user can modify)
2. Replace binary with malicious payload
3. Start service → Execute as SYSTEM

Technique 3: Writable Service Configuration
1. Find service with changeable config
2. Modify binPath to malicious executable
3. Start service → Execute as SYSTEM

Technique 4: DLL Hijacking via Service
1. Service loads DLL from writable location
2. Place malicious DLL in search path
3. Start service → Load malicious DLL as SYSTEM

Linux Service Exploitation

systemd Service Abuse:
1. Find writable service files: /etc/systemd/system/
2. Modify ExecStart= to execute backdoor
3. Reload daemon: systemctl daemon-reload
4. Start service: systemctl start <service>

Init Script Abuse:
1. Find writable /etc/init.d/ scripts
2. Add backdoor to startup script
3. Reboot or trigger service restart

PATH Manipulation:
1. Service calls system() with relative path
2. Place malicious binary in writable PATH location
3. Trigger service execution

Detection Commands

Windows:
- sc query state= all
- sc qc <servicename> (query config)
- accesschk.exe -wsqc <servicename>
- wmic service get name,pathname,displayname,startmode

Linux:
- systemctl list-units --type=service
- service --status-all
- ls -la /etc/init.d/
- find /etc/systemd/system/ -perm -o+w

Phase 3: SUID/SGID Abuse

SUID/SGID Binary Analysis

• Search for: setuid(), setgid(), seteuid(), chmod()
• Pattern: SUID binaries calling unsafe functions
• Check: Privilege dropping logic, input sanitization
• Look for: Absolute vs relative paths, environment variable usage

Common SUID Exploitation Vectors

Shell Escape:
- vim → :!/bin/sh
- less → !sh
- nmap → --interactive → !sh
- find → -exec /bin/sh \;
- awk → BEGIN {system("/bin/sh")}

Shared Library Injection:
1. SUID binary loads library (ldd <binary>)
2. LD_LIBRARY_PATH or rpath manipulation
3. Create malicious .so with __attribute__((constructor))
4. Execute SUID binary → Load library → Get shell

Environment Variable Injection:
- PATH manipulation: system("prog") uses user PATH
- IFS (Internal Field Separator): Split command arguments
- Various environment variables (TZ, etc.)

Symlink Race:
1. Find SUID that writes to file
2. Create symlink to privileged target
3. Win race between check and write

GTFOBins SUID Exploits

Known vulnerable SUID binaries:
- nmap (older versions): --interactive mode
- vim: :!command
- less: !command
- find: -exec command \;
- awk: system() function
- perl: exec() function
- python: os.system() function
- tcpdump: -z flag
- strace: executable parameter

Bypass techniques:
- Quote escaping: '"'"'
- Command chaining: ; && ||
- Variable substitution: ${IFS}

Detection Steps

1. Find SUID/SGID files: find / -perm -4000 -type f
2. Analyze binaries with strings, readelf, objdump
3. Check for unsafe function calls
4. Test library search paths (RPATH, RUNPATH)
5. Verify environment variable usage

Phase 4: PATH/DLL Hijacking

Windows DLL Search Order

SafeDllSearchMode=1 (default):
1. Application directory
2. System32 directory
3. 16-bit system directory
4. Windows directory
5. Current working directory (CWD)

Hijacking opportunities:
1. Writable application directory
2. DLL missing from System32
3. Relative loading paths
4. CWD in privileged process

Linux Shared Library Loading

Search order:
1. LD_PRELOAD (if set)
2. RPATH/RUNPATH (embedded in binary)
3. LD_LIBRARY_PATH (if set)
4. /etc/ld.so.cache
5. /lib, /usr/lib, etc.

Hijacking opportunities:
1. Writable RPATH: $ORIGIN/../lib
2. Missing library in standard paths
3. dlopen() with relative path
4. Weak library validation

Detection and Enumeration

Windows:
- Process Monitor: Watch DLL loads from writable paths
- autoruns.exe: Check auto-start locations
- List vulnerable unquoted services

Linux:
- readelf -d <binary> | grep RPATH (check RPATH)
- ldd <binary> (show library dependencies)
- strace -e open,openat <binary> (watch library loads)
- strings <binary> | grep -E "(dlopen|LD_LIBRARY)"

Exploitation Techniques

Windows DLL Proxying:
1. Export all legitimate functions (forward to real DLL)
2. Add malicious code in DllMain
3. Place proxy DLL in app directory
4. Trigger application load

Linux LD_PRELOAD:
1. Create malicious .so with constructor function
2. Export LD_PRELOAD=/path/to/malicious.so
3. Run SUID binary → Load library → Execute as owner

Linux RPATH Abuse:
1. Binary has RPATH=$ORIGIN/../lib
2. Place malicious library in relative writable path
3. Execute binary → Load library

Phase 5: Cron Job/Task Scheduler Abuse

Linux Cron Job Analysis

• Search for: /etc/cron, /var/spool/cron, crontab
• Pattern: Scripts executed by root with weak permissions
• Check: Writable cron scripts, wildcard usage
• Look for: PATH manipulation, symlink race conditions

Linux Cron Exploitation

Vulnerability 1: Writable Cron Script
1. Find script executed by root cron
2. Check permissions: ls -la /etc/cron.d/script.sh
3. If writable: Add backdoor
4. Wait for cron execution

Vulnerability 2: Wildcard Injection
Cron: * * * * * root tar -czf /backup/*.tar.gz /data
Exploit:
touch -- '-checkpoint=1'
touch -- '-checkpoint-action=exec=sh shell.sh'
Creates args: tar -czf /backup/-checkpoint=1.tar.gz ...

Vulnerability 3: PATH Manipulation
Cron: * * * * * root backup.sh
Place malicious backup.sh in writable PATH location

Vulnerability 4: Symlink Race
1. Find cron job that writes to predictable location
2. Create symlink to privileged target
3. Win race condition

Windows Task Scheduler

Enumeration:
- schtasks.exe /query /fo LIST /v
- Get-ScheduledTask (PowerShell)
- AccessChk: check task permissions

Exploitation:
1. Find writable task definitions
2. Modify task action to execute payload
3. Trigger task execution
4. Task runs as specified user (often SYSTEM)

Detection Commands

Linux:
- crontab -l (current user)
- ls -la /etc/cron* /var/spool/cron/
- cat /etc/crontab
- find /etc/cron* -type f -exec ls -la {} \;

Windows:
- schtasks /query /fo LIST /v
- Get-ScheduledTask -TaskPath \*
- powershell "Get-ScheduledTask | select *

Phase 6: Weak File Permission Exploitation

Permission Escalation Vectors

Writable /etc/passwd:
1. Add user with UID 0 (root)
2. Remove root password
3. Modify user UID to 0

Writable /etc/shadow:
1. Change root password hash
2. Add passwordless root access
3. Modify user privileges

Writable sudoers:
1. Add user to sudoers without password
2. Add ALL=(ALL) NOPASSWD: ALL
3. Modify sudo rules

Writable init scripts:
1. Add backdoor to startup sequence
2. Modify service startup
3. Trigger reboot or service restart

Linux Capabilities

Enumerate capabilities:
- getcap -r / 2>/dev/null
- capsh --print

Exploitable capabilities:
- CAP_SETUID: Can change UID (privesc)
- CAP_SETGID: Can change GID
- CAP_SYS_ADMIN: System administrator (root equivalent)
- CAP_NET_ADMIN: Network admin (packet manipulation)
- CAP_DAC_OVERRIDE: Bypass file read/write permissions

Example: Binary with CAP_SETUID
= Can execute setuid(0) to become root

Detection and Enumeration

Linux permission checks:
- ls -la /etc/passwd /etc/shadow /etc/sudoers
- find /etc/ -perm -o+w -type f
- find /var/ -perm -o+w -type f
- getcap -r / 2>/dev/null

Windows permission checks:
- icacls.exe (check file/folder permissions)
- accesschk.exe (check access rights)
- whoami /priv (show privileges)

Phase 7: Exploitability Assessment

Exploitation Primitives

Kernel LPE:
- Arbitrary read (read kernel memory)
- Arbitrary write (write kernel memory)
- Code execution in kernel context
- Token manipulation (steal system token)

Service LPE:
- Start privileged service
- Modify service configuration
- Hijack service DLL/binary

SUID LPE:
- Execute as file owner
- Load code as owner
- Write to privileged locations

PATH/DLL LPE:
- Load malicious code
- Execute in privileged context
- Hijack legitimate loading

Bypass Techniques

Signature verification bypass:
- Load unsigned drivers (test signing mode)
- Bypass driver signature checks

Permission bypass:
- Take ownership of files
- Modify ACLs/permissions
- Exploit symlink race

Mitigation bypass:
- SMEP/SMAP bypass
- CFG bypass
- KPTI bypass

Phase 8: LPE Payload Generation

Kernel Exploit Payloads

Windows Kernel Token Manipulation:
1. Find current process EPROCESS
2. Find System process EPROCESS (PID 4)
3. Copy System Token to current process
4. Spawn cmd.exe as SYSTEM

Linux Kernel Exploit:
- Dirty Cow: /proc/self/mem write
- Dirty Pipe: Splice to pipe buffer overflow
- eBPF: Write to arbitrary kernel memory

Service Exploit Payloads

Windows Service:
- sc config <service> binPath= "C:\malicious.exe"
- sc start <service>

Linux systemd:
- [Service]
- ExecStart=/tmp/backdoor.sh

Windows unquoted path:
- Create "C:\Program.exe" with backdoor

SUID Exploit Payloads

LD_PRELOAD:
#include <stdlib.h>
__attribute__((constructor))
void backdoor() {
    system("/bin/sh -i");
}

Vim shell escape:
:w !chmod +x /tmp/shell
:!/tmp/shell

Final Report

[LPE VULNERABILITY] Type at 0xADDRESS
Type: Kernel / Service / SUID / PATH / Cron
Severity: CRITICAL (SYSTEM/root access)
Impact: Complete system compromise, persistence, data access

[VECTOR]
Method: Kernel exploit / Service hijacking / SUID abuse
Privilege Level: User → Administrator/root
Exploitability: EXPLOITABLE / Complex / Requires conditions

[EXPLOITATION]
Technique: Token manipulation / Service start / SUID execution
Payload: Kernel code / DLL hijacking / SUID shell
Confirmation: Shell with elevated privileges

[REMEDIATION]
1. Install security patches
2. Remove unnecessary SUID bits
3. Fix service permissions
4. Update vulnerable drivers
5. Implement proper privilege checks

CVE Examples

Windows Kernel LPE:

• CVE-2023-21768: Windows AFD.sys LPE
• CVE-2022-21882: Win32k LPE
• CVE-2021-1732: Win32k callback LPE
• CVE-2020-0787: Bits Monster LPE

Linux Kernel LPE:

• CVE-2022-0847: Dirty Pipe
• CVE-2016-5195: Dirty Cow
• CVE-2021-4038: polkit pkexec LPE
• CVE-2022-32250: nft_object UAF

Service/LPE:

• CVE-2019-14287: sudo privilege escalation
• CVE-2019-1388: Windows UAC bypass
• CVE-2020-0668: ViewState deserialization
• CVE-2021-36934: HiveNightmare (SAM file read)

SUID/Path:

• CVE-2019-18634: sudo pwfeedback
• CVE-2015-1328: overlayfs overlayfs
• CVE-2016-2384: gnupg SUID