Table of Contents

Description
Identification
- LinPEAS
Exploitation
- Tar Capability
  - Exploiting capability using tar
Remedy
Detection
References

Description

In Linux, “capabilities” refer to the fine-grained access control mechanism that grants processes or programs specific privileges beyond those of a regular user. Traditionally, in Unix-like systems, privileges were managed through the setuid mechanism, where a program would temporarily assume the privileges of its owner when executed.

Capabilities were introduced to provide a more granular approach to privilege management, allowing processes to have only the specific privileges they need to perform their tasks, rather than having to grant them full superuser (root) privileges via setuid.

Before capabilities, we only had the binary system of privileged and non-privileged processes and for the purpose of performing permission checks, traditional UNIX implementations distinguish two categories of processes: privileged processes that referred as superuser or root and unprivileged processes (whose effective UID is nonzero).

Capabilities are those permissions that divide the privileges of kernel user or kernel level programs into small pieces so that a process can be allowed sufficient power to perform specific privileged tasks.

Some common capabilities include

These capabilities can be granted to executable files via file system attributes or via user/group privileges. Capabilities can be managed using commands like getcap and setcap in Linux.

Uses of capabilities

Limited user’s permission: Giving away too many privileges by default will result in unauthorized changes of data, backdoors and circumventing access controls, just to name a few. So to overcome this situation we can simply use the capability to limited user’s permission.

Using a fine-grained set of privileges: Suppose a web server normally runs at port 80 and we also know that we need root permissions to start listening on one of the lower ports (<1024). This web server daemon needs to be able to listen to port 80. Instead of giving this daemon all root permissions, we can set a capability on the related binary, like CAP_NET_BIND_SERVICE. With this specific capability, it can open up port 80 in a much easier way.

Working with capability

The operation of capabilities can be achieved in many ways. Some of them are listed below:

Assigning and removing capability: They are usually set on executable files and are automatically granted to the process when a file with a capability is executed. The file capability sets are stored in an extended attribute named as security.capability. This can be done by the use of attribute CAP_SETCAP capability.

To enable the capability for any file frame command as shown below:

setcap cap_setuid+ep /home/demo/python3

Similarly, one can also remove file capability by as below mentioned command.

getcap -r / 2>/dev/null

Affected products

Misconfigured Linux Operating Systems

Identification

In order to identify capabilities, we can run

getcap -r / 2> /dev/null

LinPEAS

LinPEAS script can also help us identify suspicious capabilities

./LinPEAS.sh

Exploitation

Tar Capability

We have another example “tar” which is same as above where the admin supposed to used capabilities to extract high privilege file that are restricted for other users, that should be extracted by specific user let’s say by user “demo”.

Let’s take an example: The admin wants to assign a role, where the user “demo” can take the backup of files as root, for this task the admin has set read capability on tar program. This can be accomplished with following commands on the host machine.

which tar
cp /bin/tar /home/demo/
setcap cap_dac_read_search+ep /home/demo/tar

Exploiting capability using tar

Repeat same procedure to escalate the privilege, take the access of host machine as a local user and move ahead for privilege escalation. Since this time admin has use CAP_DAC_READ_SEARCH that will help us to bypass file read permission checks and directory read and execute permission checks.

getcap -r / 2>/dev/null
pwd
ls -al tar

In this, we try to read shadow file where all system’s user password hashes are stored for this you have to follow below steps.

Compress the /etc/shadow in the current directory with the help of the tar program.

You will get shadow.tar in your current directory.

Extract the shadow.tar and you will get a directory as “etc/shadow”.

Use cat/head/tail or program to read the hashes of passwords.

./tar cvf shadow.tar /etc/shadow
ls
./tar -xvf shadow.tar

As a result, you will have “etc/shadow” file your current directory and you can read the hashes of the password as shown here.

tail -8 etc/shadow

A malicious user can break this password using a tool such as a john the ripper or hash killer etc.

Remedy

Use least privilege principles, and, confirm that no capabilities privileges are assigned to exploitable binaries.

Detection

Audit Logs (auditd):

audit.log: Contains detailed records of system calls and actions performed by users and processes. Look for entries related to capability-related system calls, such as capset, setuid, setgid, etc.

System Logs (syslog):

syslog, messages: These logs contain general system activity, including errors, warnings, and informational messages. Look for any unusual or suspicious activity related to capability changes or privilege escalation attempts.

Kernel Logs:

kern.log or dmesg: Contains kernel-level messages, including errors and warnings. Monitor for any kernel-level events related to capabilities, such as loading or unloading of kernel modules (CAP_SYS_MODULE), changes to system time (CAP_SYS_TIME), etc.

File System Logs:

audit.log, syslog, or distribution-specific logs: Monitor file system events, such as changes to file permissions or ownership, which may indicate tampering with files related to capabilities management (CAP_CHOWN, CAP_DAC_OVERRIDE, etc.).

Process Execution Logs:

audit.log, syslog, or process-specific logs: Track process execution events and command-line arguments to identify suspicious processes attempting to escalate privileges or perform actions beyond their normal scope (CAP_SYS_PTRACE, CAP_SYS_ADMIN, etc.).

Network Logs:

Firewall logs, packet capture logs, or network device logs: Look for network activity originating from processes with elevated capabilities (CAP_NET_RAW, CAP_NET_ADMIN, etc.), which may indicate attempts to exploit network-related capabilities.