From 63708a9157ede809bad477879776b569bbbf8cf7 Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Thu, 6 Aug 2026 10:23:21 +0200 Subject: [PATCH 1/6] References audit: numbered citations for 50 pages Audits the '## References' of these pages: merges duplicated reference sections into one, numbers every entry, adds the linked [[N]](#references) citations to the content each reference is the source of, drops unused references and credits the original research. Co-Authored-By: Claude Opus 5 (1M context) --- .../basic-forensic-methodology/README.md | 77 ------------------- .../phishing-documents.md | 2 +- .../python/README.md | 3 - .../python/basic-python.md | 2 +- .../python/bruteforce-hash-few-chars.md | 2 - .../python/bypass-python-sandboxes/README.md | 12 +-- .../js2py-sandbox-escape-cve-2024-28397.md | 4 +- .../load_name-load_const-opcode-oob-read.md | 3 +- ...xpression-evaluation-rce-cve-2023-33733.md | 2 +- ...s-pollution-pythons-prototype-pollution.md | 8 +- ...-deserialization-rce-and-gadget-hunting.md | 6 +- .../python/pyscript.md | 5 +- .../python/python-internal-read-gadgets.md | 1 + .../python/venv.md | 2 - .../python/web-requests.md | 2 - ...-channel-attacks-on-messaging-protocols.md | 8 +- .../threat-modeling.md | 1 - .../escaping-from-gui-applications.md | 19 ++--- .../firmware-analysis/README.md | 44 +++++------ ...mediatek-secure-boot-bl2_ext-bypass-el3.md | 40 +++++----- .../firmware-analysis/bootloader-testing.md | 44 ++++++----- .../firmware-analysis/firmware-integrity.md | 12 +-- .../container-security/protections/selinux.md | 10 ++- .../runtime-api-and-daemon-exposure.md | 1 + .../runtimes-and-engines.md | 7 +- .../sensitive-host-mounts.md | 2 +- .../containerd-ctr-privilege-escalation.md | 2 - .../runc-privilege-escalation.md | 3 - .../ld.so.conf-example.md | 2 - .../linux-capabilities.md | 10 +-- .../nfs-no_root_squash-misconfiguration-pe.md | 4 - .../interesting-files-permissions/selinux.md | 2 +- .../suid-shared-library-and-linker-abuse.md | 1 + .../linux-environment-variables.md | 3 +- .../linux-privilege-escalation/README.md | 21 +++-- .../linux-basics/useful-linux-commands.md | 1 - .../escaping-from-limited-bash.md | 8 +- .../filesystem-inodes-and-recovery.md | 1 + ...ice-page-cache-overwrite-cve-2026-31431.md | 2 +- ...x-ptrace-exit-race-pidfd_getfd-fd-theft.md | 2 +- .../posix-cpu-timers-toctou-cve-2025-38352.md | 4 +- ...ry-untrusted-search-path-cve-2025-41244.md | 2 +- .../kernel-modules-and-modprobe.md | 1 + .../linux-privilege-escalation-checklist.md | 6 +- .../sudo-command-abuse.md | 1 + .../network-information/cisco-vmanage.md | 5 +- .../local-network-and-socket-triage.md | 1 + .../socket-command-injection.md | 1 - .../linux-post-exploitation/README.md | 2 +- ...-command-injection-privilege-escalation.md | 9 ++- 50 files changed, 168 insertions(+), 245 deletions(-) diff --git a/src/generic-methodologies-and-resources/basic-forensic-methodology/README.md b/src/generic-methodologies-and-resources/basic-forensic-methodology/README.md index ae69ddfc0da..7ba1b51d3fd 100644 --- a/src/generic-methodologies-and-resources/basic-forensic-methodology/README.md +++ b/src/generic-methodologies-and-resources/basic-forensic-methodology/README.md @@ -23,33 +23,6 @@ malware-analysis.md if you are given a **forensic image** of a device you can start **analyzing the partitions, file-system** used and **recovering** potentially **interesting files** (even deleted ones). Learn how in: -{{#ref}} -partitions-file-systems-carving/ -{{#endref}}# Basic Forensic Methodology - - - -## Creating and Mounting an Image - - -{{#ref}} -../../generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.md -{{#endref}} - -## Malware Analysis - -This **isn't necessary the first step to perform once you have the image**. But you can use this malware analysis techniques independently if you have a file, a file-system image, memory image, pcap... so it's good to **keep these actions in mind**: - - -{{#ref}} -malware-analysis.md -{{#endref}} - -## Inspecting an Image - -if you are given a **forensic image** of a device you can start **analyzing the partitions, file-system** used and **recovering** potentially **interesting files** (even deleted ones). Learn how in: - - {{#ref}} partitions-file-systems-carving/ {{#endref}} @@ -119,58 +92,8 @@ anti-forensic-techniques.md ## Threat Hunting -{{#ref}} -file-integrity-monitoring.md -{{#endref}} - - - -## Deep inspection of specific file-types and Software - -If you have very **suspicious** **file**, then **depending on the file-type and software** that created it several **tricks** may be useful.\ -Read the following page to learn some interesting tricks: - - -{{#ref}} -specific-software-file-type-tricks/ -{{#endref}} - -I want to do a special mention to the page: - - -{{#ref}} -specific-software-file-type-tricks/browser-artifacts.md -{{#endref}} - -## Memory Dump Inspection - - -{{#ref}} -memory-dump-analysis/ -{{#endref}} - -## Pcap Inspection - - -{{#ref}} -pcap-inspection/ -{{#endref}} - -## **Anti-Forensic Techniques** - -Keep in mind the possible use of anti-forensic techniques: - - -{{#ref}} -anti-forensic-techniques.md -{{#endref}} - -## Threat Hunting - - {{#ref}} file-integrity-monitoring.md {{#endref}} {{#include ../../banners/hacktricks-training.md}} - diff --git a/src/generic-methodologies-and-resources/phishing-methodology/phishing-documents.md b/src/generic-methodologies-and-resources/phishing-methodology/phishing-documents.md index 79af866bd52..33482e65da1 100644 --- a/src/generic-methodologies-and-resources/phishing-methodology/phishing-documents.md +++ b/src/generic-methodologies-and-resources/phishing-methodology/phishing-documents.md @@ -342,7 +342,7 @@ See also stego tools and carving techniques: ## JS/VBS droppers → Base64 PowerShell staging -A recurring initial stage is a small, heavily‑obfuscated `.js` or `.vbs` delivered inside an archive. Its sole purpose is to decode an embedded Base64 string and launch PowerShell with `-nop -w hidden -ep bypass` to bootstrap the next stage over HTTPS. +A recurring initial stage is a small, heavily‑obfuscated `.js` or `.vbs` delivered inside an archive. Its sole purpose is to decode an embedded Base64 string and launch PowerShell with `-nop -w hidden -ep bypass` to bootstrap the next stage over HTTPS.[[5]](#references) Skeleton logic (abstract): - Read own file contents diff --git a/src/generic-methodologies-and-resources/python/README.md b/src/generic-methodologies-and-resources/python/README.md index d8ff0b2ea50..bca3de896a5 100644 --- a/src/generic-methodologies-and-resources/python/README.md +++ b/src/generic-methodologies-and-resources/python/README.md @@ -13,6 +13,3 @@ - [**Basic python syntax and libraries**](basic-python.md) {{#include ../../banners/hacktricks-training.md}} - - - diff --git a/src/generic-methodologies-and-resources/python/basic-python.md b/src/generic-methodologies-and-resources/python/basic-python.md index 6605eeea848..13f457582c0 100644 --- a/src/generic-methodologies-and-resources/python/basic-python.md +++ b/src/generic-methodologies-and-resources/python/basic-python.md @@ -479,6 +479,6 @@ with zipfile.ZipFile("sample.zip") as zf: ## References - [1] [Python tarfile docs](https://docs.python.org/3/library/tarfile.html) -- [2] [PEP 706 - Filter for tarfile.extractall](https://peps.python.org/pep-0706/) +- [2] [PEP 706 – Filter for tarfile.extractall()](https://peps.python.org/pep-0706/) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/generic-methodologies-and-resources/python/bruteforce-hash-few-chars.md b/src/generic-methodologies-and-resources/python/bruteforce-hash-few-chars.md index 6b983a93549..1eb9ef5b35f 100644 --- a/src/generic-methodologies-and-resources/python/bruteforce-hash-few-chars.md +++ b/src/generic-methodologies-and-resources/python/bruteforce-hash-few-chars.md @@ -55,5 +55,3 @@ main() {{#include ../../banners/hacktricks-training.md}} - - diff --git a/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/README.md b/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/README.md index 7aafd13709c..e6bfdafdb83 100644 --- a/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/README.md +++ b/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/README.md @@ -2,7 +2,7 @@ {{#include ../../../banners/hacktricks-training.md}} -These are some tricks to bypass python sandbox protections and execute arbitrary commands. +These are some tricks to bypass python sandbox protections and execute arbitrary commands.[[1]](#references)[[2]](#references) {{#ref}} js2py-sandbox-escape-cve-2024-28397.md @@ -313,7 +313,7 @@ __ixor__ (k ^= 'import os; os.system("sh")') #### Crating objects with [metaclasses](https://docs.python.org/3/reference/datamodel.html#metaclasses) -The key thing that metaclasses allow us to do is **make an instance of a class, without calling the constructor** directly, by creating a new class with the target class as a metaclass. +The key thing that metaclasses allow us to do is **make an instance of a class, without calling the constructor** directly, by creating a new class with the target class as a metaclass.[[15]](#references) ```python # Code from https://ur4ndom.dev/posts/2022-07-04-gctf-treebox/ and fixed @@ -404,7 +404,7 @@ __builtins__.__dict__['__import__']("os").system("ls") ### No Builtins When you don't have `__builtins__` you are not going to be able to import anything nor even read or write files as **all the global functions** (like `open`, `import`, `print`...) **aren't loaded**.\ -However, **by default python imports a lot of modules in memory**. These modules may seem benign, but some of them are **also importing dangerous** functionalities inside of them that can be accessed to gain even **arbitrary code execution**. +However, **by default python imports a lot of modules in memory**. These modules may seem benign, but some of them are **also importing dangerous** functionalities inside of them that can be accessed to gain even **arbitrary code execution**.[[4]](#references)[[5]](#references) In the following examples you can observe how to **abuse** some of this "**benign**" modules loaded to **access** **dangerous** **functionalities** inside of them. @@ -776,7 +776,7 @@ https://github.com/carlospolop/hacktricks/blob/master/generic-methodologies-and- ## Python Format String -If you **send** a **string** to python that is going to be **formatted**, you can use `{}` to access **python internal information.** You can use the previous examples to access globals or builtins for example. +If you **send** a **string** to python that is going to be **formatted**, you can use `{}` to access **python internal information.** You can use the previous examples to access globals or builtins for example.[[14]](#references) ```python # Example from https://www.geeksforgeeks.org/vulnerability-in-str-format-in-python/ @@ -1064,7 +1064,7 @@ dis.dis('d\x01\x00}\x01\x00d\x02\x00}\x02\x00d\x03\x00d\x04\x00g\x02\x00}\x03\x0 ## Compiling Python Now, let us imagine that somehow you can **dump the information about a function that you cannot execute** but you **need** to **execute** it.\ -Like in the following example, you **can access the code object** of that function, but just reading the disassemble you **don't know how to calculate the flag** (_imagine a more complex `calc_flag` function_) +Like in the following example, you **can access the code object** of that function, but just reading the disassemble you **don't know how to calculate the flag** (_imagine a more complex `calc_flag` function_)[[3]](#references) ```python def get_flag(some_input): @@ -1215,5 +1215,7 @@ will be bypassed - [11] [SECCON CTF 2022 Quals: Author writeups (English)](https://blog.arkark.dev/2022/11/18/seccon-en/#misc-latexipy) - [12] [Anatomy of an LLM RCE - CyberArk Threat Research Blog](https://www.cyberark.com/resources/threat-research-blog/anatomy-of-an-llm-rce) - [13] [BuckeyeCTF 2024 Author Writeups](https://corgi.rip/posts/buckeye-writeups/) +- [14] [GeeksforGeeks – Vulnerability in str.format() in Python](https://www.geeksforgeeks.org/vulnerability-in-str-format-in-python/) +- [15] [ur4ndom – [GCTF 2022] Treebox](https://ur4ndom.dev/posts/2022-07-04-gctf-treebox/) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/js2py-sandbox-escape-cve-2024-28397.md b/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/js2py-sandbox-escape-cve-2024-28397.md index e62a7fc5a54..d3c8690872d 100644 --- a/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/js2py-sandbox-escape-cve-2024-28397.md +++ b/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/js2py-sandbox-escape-cve-2024-28397.md @@ -67,9 +67,9 @@ PY ## Operating against web sandboxes -- Any endpoint that feeds attacker-controlled JS into `js2py.eval_js` (for example, a Flask `/run_code` API) is immediately RCE if the process user has shell access. +- Any endpoint that feeds attacker-controlled JS into `js2py.eval_js` (for example, a Flask `/run_code` API) is immediately RCE if the process user has shell access.[[2]](#references) - Returning `jsonify({'result': result})` will fail when `.communicate()` returns bytes; decode or direct output to DNS/ICMP to avoid serialization blockers. -- `disable_pyimport()` **does not** mitigate this chain; hard isolation (separate process/container) or removing Js2Py execution of untrusted code is required.[[2]](#references) +- `disable_pyimport()` **does not** mitigate this chain; hard isolation (separate process/container) or removing Js2Py execution of untrusted code is required. ## References diff --git a/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/load_name-load_const-opcode-oob-read.md b/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/load_name-load_const-opcode-oob-read.md index 90d4186e2ba..667517a9b00 100644 --- a/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/load_name-load_const-opcode-oob-read.md +++ b/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/load_name-load_const-opcode-oob-read.md @@ -349,10 +349,9 @@ Additional mitigation ideas - Don’t allow arbitrary `CodeType.replace(...)` on untrusted input, or add strict structural checks on the resulting code object. - Consider running untrusted code in a separate process with OS-level sandboxing (seccomp, job objects, containers) instead of relying on CPython semantics. - - ## References - [1] [Splitline's HITCON CTF 2022 writeup "V O I D" (origin of this technique and high-level exploit chain)](https://blog.splitline.tw/hitcon-ctf-2022/) - [2] [Python disassembler docs (indices semantics for LOAD_CONST/LOAD_NAME/etc., and 3.11+ `LOAD_ATTR`/`LOAD_GLOBAL` low-bit flags)](https://docs.python.org/3.13/library/dis.html) + {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/reportlab-xhtml2pdf-triple-brackets-expression-evaluation-rce-cve-2023-33733.md b/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/reportlab-xhtml2pdf-triple-brackets-expression-evaluation-rce-cve-2023-33733.md index de2dc852af1..bac70432ea7 100644 --- a/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/reportlab-xhtml2pdf-triple-brackets-expression-evaluation-rce-cve-2023-33733.md +++ b/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/reportlab-xhtml2pdf-triple-brackets-expression-evaluation-rce-cve-2023-33733.md @@ -7,7 +7,7 @@ This page documents a practical sandbox escape and RCE primitive in ReportLab’ CVE-2023-33733 affects ReportLab versions up to and including 3.6.12.[[3]](#references) In certain attribute contexts (for example color), values wrapped in triple brackets [[[ ... ]]] are evaluated server-side by rl_safe_eval. By crafting a payload that pivots from a whitelisted builtin (pow) to its Python function globals, an attacker can reach the os module and execute commands.[[1]](#references) Key points -- Trigger: inject [[[ ... ]]] into evaluated attributes such as or any style path that eventually reaches `reportlab.lib.colors.toColor` within ReportLab/xhtml2pdf. +- Trigger: inject [[[ ... ]]] into evaluated attributes such as or any style path that eventually reaches `reportlab.lib.colors.toColor` within ReportLab/xhtml2pdf.[[4]](#references) - Sandbox: rl_safe_eval replaces dangerous builtins but evaluated functions still expose __globals__. - Bypass: craft a transient class Word to bypass rl_safe_eval name checks and access the string "__globals__" while avoiding blocked dunder filtering. - RCE: `getattr(pow, Word('__globals__'))['os'].system('')` diff --git a/src/generic-methodologies-and-resources/python/class-pollution-pythons-prototype-pollution.md b/src/generic-methodologies-and-resources/python/class-pollution-pythons-prototype-pollution.md index c2540b498fe..a7f3e783166 100644 --- a/src/generic-methodologies-and-resources/python/class-pollution-pythons-prototype-pollution.md +++ b/src/generic-methodologies-and-resources/python/class-pollution-pythons-prototype-pollution.md @@ -69,7 +69,7 @@ print(vars(emp)) #{'name': 'Ahemd', 'age': 23, 'manager': {'name': 'Sarah'}}
-Creating class property default value to RCE (subprocess) +Creating class property default value to RCE (subprocess)[[1]](#references) ```python from os import popen @@ -122,7 +122,7 @@ print(system_admin_emp.execute_command())
-Polluting other classes and global vars through globals +Polluting other classes and global vars through globals[[1]](#references) ```python def merge(src, dst): @@ -156,7 +156,7 @@ print(NotAccessibleClass) #>
-Arbitrary subprocess execution +Arbitrary subprocess execution[[1]](#references) ```python import subprocess, json @@ -270,5 +270,3 @@ python-internal-read-gadgets.md - [2] [CTFtime - idekCTF 2022: task manager writeup](https://ctftime.org/writeup/36082) {{#include ../../banners/hacktricks-training.md}} - - diff --git a/src/generic-methodologies-and-resources/python/keras-model-deserialization-rce-and-gadget-hunting.md b/src/generic-methodologies-and-resources/python/keras-model-deserialization-rce-and-gadget-hunting.md index 253c64876f9..2f4fb551047 100644 --- a/src/generic-methodologies-and-resources/python/keras-model-deserialization-rce-and-gadget-hunting.md +++ b/src/generic-methodologies-and-resources/python/keras-model-deserialization-rce-and-gadget-hunting.md @@ -74,7 +74,7 @@ Notes: Root cause: - _retrieve_class_or_fn used unrestricted importlib.import_module() with attacker-controlled module strings from config.json. -- Impact: Arbitrary import of any installed module (or attacker-planted module on sys.path). Import-time code runs, then object construction occurs with attacker kwargs.[[1]](#references)[[4]](#references) +- Impact: Arbitrary import of any installed module (or attacker-planted module on sys.path). Import-time code runs, then object construction occurs with attacker kwargs.[[1]](#references)[[4]](#references)[[5]](#references)[[6]](#references) Exploit idea: @@ -192,9 +192,9 @@ fickling.hook.activate_safe_ml_environment(also_allow=[ - with fickling.check_safety(): for scoped enforcement - fickling.load(path) / fickling.is_likely_safe(path) for one-off checks -- Prefer non-pickle model formats when possible (e.g., SafeTensors). If you must accept pickle, run loaders under least privilege without network egress and enforce the allowlist. +- Prefer non-pickle model formats when possible (e.g., SafeTensors).[[15]](#references) If you must accept pickle, run loaders under least privilege without network egress and enforce the allowlist. -This allowlist-first strategy demonstrably blocks common ML pickle exploit paths while keeping compatibility high. In ToB’s benchmark, Fickling flagged 100% of synthetic malicious files and allowed ~99% of clean files from top Hugging Face repos.[[8]](#references) +This allowlist-first strategy demonstrably blocks common ML pickle exploit paths while keeping compatibility high. In ToB’s benchmark, Fickling flagged 100% of synthetic malicious files and allowed ~99% of clean files from top Hugging Face repos.[[8]](#references)[[10]](#references) ## Researcher toolkit diff --git a/src/generic-methodologies-and-resources/python/pyscript.md b/src/generic-methodologies-and-resources/python/pyscript.md index 6041a8cec85..49b24949957 100644 --- a/src/generic-methodologies-and-resources/python/pyscript.md +++ b/src/generic-methodologies-and-resources/python/pyscript.md @@ -8,7 +8,7 @@ PyScript is a new framework developed for integrating Python into HTML so, it ca ### Dumping / Retrieving files from the Emscripten virtual memory filesystem: -`CVE ID: CVE-2022-30286`\ +`CVE ID: CVE-2022-30286`[[3]](#references)\ \ Code: @@ -25,7 +25,7 @@ Result: ### [OOB Data Exfiltration of the Emscripten virtual memory filesystem (console monitoring)](https://github.com/s/jcd3T19P0M8QRnU1KRDk/~/changes/Wn2j4r8jnHsV8mBiqPk5/blogs/the-art-of-vulnerability-chaining-pyscript) -`CVE ID: CVE-2022-30286`\ +`CVE ID: CVE-2022-30286`[[3]](#references)\ \ Code: @@ -243,5 +243,6 @@ This behaviour was introduced in 2023 and is documented in the official Built-in - [1] [NVD – CVE-2025-50182](https://nvd.nist.gov/vuln/detail/CVE-2025-50182) - [2] [PyScript Built-ins documentation – `display` & `HTML`](https://docs.pyscript.net/2024.6.1/user-guide/builtins/) +- [3] [Cyber Guy - The Art of Vulnerability Chaining (PyScript)](https://cyber-guy.gitbook.io/cyber-guy/blogs/the-art-of-vulnerability-chaining-pyscript) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/generic-methodologies-and-resources/python/python-internal-read-gadgets.md b/src/generic-methodologies-and-resources/python/python-internal-read-gadgets.md index 0307954c255..bb320158ccf 100644 --- a/src/generic-methodologies-and-resources/python/python-internal-read-gadgets.md +++ b/src/generic-methodologies-and-resources/python/python-internal-read-gadgets.md @@ -2,6 +2,7 @@ {{#include ../../banners/hacktricks-training.md}} + ## Basic Information Different vulnerabilities such as [**Python Format Strings**](bypass-python-sandboxes/index.html#python-format-string) or [**Class Pollution**](class-pollution-pythons-prototype-pollution.md) might allow you to **read python internal data but won't allow you to execute code**. Therefore, a pentester will need to make the most of these read permissions to **obtain sensitive privileges and escalate the vulnerability**. diff --git a/src/generic-methodologies-and-resources/python/venv.md b/src/generic-methodologies-and-resources/python/venv.md index 572bdfbf74d..5cc906d799d 100644 --- a/src/generic-methodologies-and-resources/python/venv.md +++ b/src/generic-methodologies-and-resources/python/venv.md @@ -24,5 +24,3 @@ inside the virtual environment {{#include ../../banners/hacktricks-training.md}} - - diff --git a/src/generic-methodologies-and-resources/python/web-requests.md b/src/generic-methodologies-and-resources/python/web-requests.md index f33fa31f013..6e05578808c 100644 --- a/src/generic-methodologies-and-resources/python/web-requests.md +++ b/src/generic-methodologies-and-resources/python/web-requests.md @@ -104,5 +104,3 @@ term.cmdloop() {{#include ../../banners/hacktricks-training.md}} - - diff --git a/src/generic-methodologies-and-resources/side-channel-attacks-on-messaging-protocols.md b/src/generic-methodologies-and-resources/side-channel-attacks-on-messaging-protocols.md index 60880a7cc8c..f804dc909e2 100644 --- a/src/generic-methodologies-and-resources/side-channel-attacks-on-messaging-protocols.md +++ b/src/generic-methodologies-and-resources/side-channel-attacks-on-messaging-protocols.md @@ -36,16 +36,16 @@ Two threat actors are sufficient to describe the abuse surface:[[1]](#refer Rely on clients that expose the underlying E2EE protocol so you can craft packets outside UI constraints, specify arbitrary `message_id`s, and log precise timestamps: -* **WhatsApp:** [whatsmeow](https://github.com/tulir/whatsmeow) (Go, WhatsApp Web protocol) or [Cobalt](https://github.com/Auties00/Cobalt) (mobile-oriented) let you emit raw `ReactionMessage`, `ProtocolMessage` (edit/delete), and `Receipt` frames while keeping the double-ratchet state in sync. -* **Signal:** [signal-cli](https://github.com/AsamK/signal-cli) combined with [libsignal-service-java](https://github.com/signalapp/libsignal-service-java) exposes every message type via CLI/API. Current `signal-cli` syntax uses `sendReaction RECIPIENT --target-author --target-timestamp`; keep `receive` or `daemon` running so delivery receipts are actually collected. Example self-reaction toggle: +* **WhatsApp:** [whatsmeow](https://github.com/tulir/whatsmeow) (Go, WhatsApp Web protocol) or [Cobalt](https://github.com/Auties00/Cobalt) (mobile-oriented) let you emit raw `ReactionMessage`, `ProtocolMessage` (edit/delete), and `Receipt` frames while keeping the double-ratchet state in sync.[[3]](#references)[[4]](#references) +* **Signal:** [signal-cli](https://github.com/AsamK/signal-cli) combined with [libsignal-service-java](https://github.com/signalapp/libsignal-service-java) exposes every message type via CLI/API.[[5]](#references)[[7]](#references) Current `signal-cli` syntax uses `sendReaction RECIPIENT --target-author --target-timestamp`; keep `receive` or `daemon` running so delivery receipts are actually collected.[[6]](#references) Example self-reaction toggle: ```bash signal-cli -a +12025550100 sendReaction +12025550123 --target-author +12025550100 \ --target-timestamp 1712345678901 --emoji "👍" signal-cli -a +12025550100 sendReaction +12025550123 --target-author +12025550100 \ --target-timestamp 1712345678901 --remove ``` -* **Threema:** Source of the Android client documents how delivery receipts are consolidated before they leave the device, explaining why the side channel has negligible bandwidth there. -* **Turnkey PoCs:** [device-activity-tracker](https://github.com/gommzystudio/device-activity-tracker) ships WhatsApp/Signal backends, defaults to silent delete probes, and labels `active` vs `standby` with a rolling-median threshold (`RTT < 0.9 * median`). [careless-whisper-python](https://github.com/ctrlsam/careless-whisper-python) is a lighter WhatsApp-first CLI with `--delay`, `--concurrent`, CSV/Prometheus exporters, and Grafana-friendly output. Treat both as reconnaissance helpers rather than protocol references; the important takeaway is how little code is needed once raw client access exists. +* **Threema:** Source of the Android client documents how delivery receipts are consolidated before they leave the device, explaining why the side channel has negligible bandwidth there.[[1]](#references) +* **Turnkey PoCs:** [device-activity-tracker](https://github.com/gommzystudio/device-activity-tracker) ships WhatsApp/Signal backends, defaults to silent delete probes, and labels `active` vs `standby` with a rolling-median threshold (`RTT < 0.9 * median`).[[8]](#references) [careless-whisper-python](https://github.com/ctrlsam/careless-whisper-python) is a lighter WhatsApp-first CLI with `--delay`, `--concurrent`, CSV/Prometheus exporters, and Grafana-friendly output.[[9]](#references) Treat both as reconnaissance helpers rather than protocol references; the important takeaway is how little code is needed once raw client access exists. When custom tooling is unavailable, you can still trigger silent actions from WhatsApp Web or Signal Desktop and sniff the encrypted websocket/WebRTC channel, but raw APIs remove UI delays and allow invalid operations. diff --git a/src/generic-methodologies-and-resources/threat-modeling.md b/src/generic-methodologies-and-resources/threat-modeling.md index 87bf50c2ad9..6d2e0d4de9d 100644 --- a/src/generic-methodologies-and-resources/threat-modeling.md +++ b/src/generic-methodologies-and-resources/threat-modeling.md @@ -112,5 +112,4 @@ Now your finished model should look something like this. And this is how you mak This is a free tool from Microsoft that helps in finding threats in the design phase of software projects. It uses the STRIDE methodology and is particularly suitable for those developing on Microsoft's stack. - {{#include ../banners/hacktricks-training.md}} diff --git a/src/hardware-physical-access/escaping-from-gui-applications.md b/src/hardware-physical-access/escaping-from-gui-applications.md index f67688fc3dc..9fd8a081aa9 100644 --- a/src/hardware-physical-access/escaping-from-gui-applications.md +++ b/src/hardware-physical-access/escaping-from-gui-applications.md @@ -70,7 +70,7 @@ _bash, sh, zsh..._ More here: [https://gtfobins.github.io/](https://gtfobins.git ### Restricted Desktop Breakouts (Citrix/RDS/VDI) -- **Dialog-box pivoting**: Use *Open/Save/Print-to-file* dialogs as Explorer-lite. Try `*.*` / `*.exe` in the filename field, right-click folders for **Open in new window**, and use **Properties → Open file location** to expand navigation. +- **Dialog-box pivoting**: Use *Open/Save/Print-to-file* dialogs as Explorer-lite. Try `*.*` / `*.exe` in the filename field, right-click folders for **Open in new window**, and use **Properties → Open file location** to expand navigation.[[1]](#references) - **Create execution paths from dialogs**: Create a new file and rename it to `.CMD` or `.BAT`, or create a shortcut pointing to `%WINDIR%\System32` (or a specific binary like `%WINDIR%\System32\cmd.exe`). - **Shell launch pivots**: If you can browse to `cmd.exe`, try **drag-and-drop** any file onto it to launch a prompt. If Task Manager is reachable (`CTRL+SHIFT+ESC`), use **Run new task**. - **Task Scheduler bypass**: If interactive shells are blocked but scheduling is allowed, create a task to run `cmd.exe` (GUI `taskschd.msc` or `schtasks.exe`). @@ -181,7 +181,7 @@ Backup iKat versions: [http://swin.es/k/](http://swin.es/k/)\ [http://www.ikat.kronicd.net/](http://www.ikat.kronicd.net) -Create a common dialog using JavaScript and access file explorer: `document.write('')`\ +Create a common dialog using JavaScript and access file explorer: `document.write('')`[[2]](#references)\ Source: https://medium.com/@Rend\_/give-me-a-browser-ill-give-you-a-shell-de19811defa0 ## iPad @@ -198,11 +198,11 @@ Source: https://medium.com/@Rend\_/give-me-a-browser-ill-give-you-a-shell-de1981 - Swipe fast 1 finger from the centre of the screen to the right or left: To change to next/last App - Press and hold the On/**Off**/Sleep button at the upper-right corner of the **iPad +** Move the Slide to **power off** slider all the way to the right: To power off - Press the On/**Off**/Sleep button at the upper-right corner of the **iPad and the Home button for a few second**: To force a hard power off -- Press the On/**Off**/Sleep button at the upper-right corner of the **iPad and the Home button quickly**: To take a screenshot that will pop up in the lower left of the display. Press both buttons at the same time very briefly as if you hold them a few seconds a hard power off will be performed. +- Press the On/**Off**/Sleep button at the upper-right corner of the **iPad and the Home button quickly**: To take a screenshot that will pop up in the lower left of the display. Press both buttons at the same time very briefly as if you hold them a few seconds a hard power off will be performed.[[3]](#references) ### Shortcuts -You should have an iPad keyboard or a USB keyboard adaptor. Only shortcuts that could help escaping from the application will be shown here. +You should have an iPad keyboard or a USB keyboard adaptor. Only shortcuts that could help escaping from the application will be shown here.[[4]](#references)[[5]](#references)[[6]](#references) | Key | Name | | --- | ------------ | @@ -291,10 +291,11 @@ These shortcuts are for the visual settings and sound settings, depending on the ## References -- [https://www.pentestpartners.com/security-blog/breaking-out-of-citrix-and-other-restricted-desktop-environments/](https://www.pentestpartners.com/security-blog/breaking-out-of-citrix-and-other-restricted-desktop-environments/) -- [https://www.macworld.com/article/2975857/6-only-for-ipad-gestures-you-need-to-know.html](https://www.macworld.com/article/2975857/6-only-for-ipad-gestures-you-need-to-know.html) -- [https://www.tomsguide.com/us/ipad-shortcuts,news-18205.html](https://www.tomsguide.com/us/ipad-shortcuts,news-18205.html) -- [https://thesweetsetup.com/best-ipad-keyboard-shortcuts/](https://thesweetsetup.com/best-ipad-keyboard-shortcuts/) -- [http://www.iphonehacks.com/2018/03/ipad-keyboard-shortcuts.html](http://www.iphonehacks.com/2018/03/ipad-keyboard-shortcuts.html) +- [1] [Breaking Out of Citrix and other Restricted Desktop Environments](https://www.pentestpartners.com/security-blog/breaking-out-of-citrix-and-other-restricted-desktop-environments/) +- [2] [Give me a browser, I'll give you a shell](https://medium.com/@Rend_/give-me-a-browser-ill-give-you-a-shell-de19811defa0) +- [3] [6 only-for-iPad gestures you need to know](https://www.macworld.com/article/2975857/6-only-for-ipad-gestures-you-need-to-know.html) +- [4] [iPad shortcuts guide](https://www.tomsguide.com/us/ipad-shortcuts,news-18205.html) +- [5] [Best iPad Keyboard Shortcuts](https://thesweetsetup.com/best-ipad-keyboard-shortcuts/) +- [6] [iPad Keyboard Shortcuts](http://www.iphonehacks.com/2018/03/ipad-keyboard-shortcuts.html) {{#include ../banners/hacktricks-training.md}} diff --git a/src/hardware-physical-access/firmware-analysis/README.md b/src/hardware-physical-access/firmware-analysis/README.md index c2df5bd0e98..7892d9abeaa 100644 --- a/src/hardware-physical-access/firmware-analysis/README.md +++ b/src/hardware-physical-access/firmware-analysis/README.md @@ -23,7 +23,7 @@ android-mediatek-secure-boot-bl2_ext-bypass-el3.md mediatek-xflash-carbonara-da2-hash-bypass.md {{#endref}} -Firmware is essential software that enables devices to operate correctly by managing and facilitating communication between the hardware components and the software that users interact with. It's stored in permanent memory, ensuring the device can access vital instructions from the moment it's powered on, leading to the operating system's launch. Examining and potentially modifying firmware is a critical step in identifying security vulnerabilities. +Firmware is essential software that enables devices to operate correctly by managing and facilitating communication between the hardware components and the software that users interact with. It's stored in permanent memory, ensuring the device can access vital instructions from the moment it's powered on, leading to the operating system's launch. Examining and potentially modifying firmware is a critical step in identifying security vulnerabilities.[[2]](#references)[[3]](#references) ## **Gathering Information** @@ -58,7 +58,7 @@ Obtaining firmware can be approached through various means, each with its own le ### UART-only logs: force a root shell via U-Boot env in flash -If UART RX is ignored (logs only), you can still force an init shell by **editing the U-Boot environment blob** offline: +If UART RX is ignored (logs only), you can still force an init shell by **editing the U-Boot environment blob** offline:[[6]](#references) 1. Dump SPI flash with a SOIC-8 clip + programmer (3.3V): ```bash @@ -207,7 +207,7 @@ Both source code and compiled binaries found in the filesystem must be scrutiniz ## Harvesting cloud config and MQTT credentials via derived URL tokens -Many IoT hubs fetch their per-device configuration from a cloud endpoint that looks like: +Many IoT hubs fetch their per-device configuration from a cloud endpoint that looks like:[[5]](#references) - `https:///pf//` @@ -324,7 +324,7 @@ At this stage, either a real or emulated device environment is used for analysis Runtime analysis involves interacting with a process or binary in its operating environment, using tools like gdb-multiarch, Frida, and Ghidra for setting breakpoints and identifying vulnerabilities through fuzzing and other techniques. -For embedded targets without a full debugger, **copy a statically-linked `gdbserver`** to the device and attach remotely: +For embedded targets without a full debugger, **copy a statically-linked `gdbserver`** to the device and attach remotely:[[6]](#references) ```bash # On device @@ -339,7 +339,7 @@ target remote :1234 ### Zigbee / radio-co-processor message mapping -On IoT hubs the RF stack is often split between a **radio MCU** and a Linux userland process. A useful workflow is to map the path: +On IoT hubs the RF stack is often split between a **radio MCU** and a Linux userland process. A useful workflow is to map the path:[[8]](#references) 1. **RF frame** on the air 2. **controller-side parser** on the radio MCU @@ -358,7 +358,7 @@ For Zigbee specifically, capture pairing traffic and check whether the target st ### Manufacturer-specific protocol handlers and FSM-gated reachability -Vendor-specific Zigbee/ZCL commands are often a better target than standardized clusters because they feed **custom parsing code** and internal **FSMs** with less battle-tested validation. +Vendor-specific Zigbee/ZCL commands are often a better target than standardized clusters because they feed **custom parsing code** and internal **FSMs** with less battle-tested validation.[[8]](#references) Practical workflow: @@ -371,7 +371,7 @@ For timing-sensitive protocols, packet replay from a Python framework may be too ### Fragmented-download bug class in embedded daemons -A recurring firmware bug class appears in **fragmented blob/model/configuration downloads**: +A recurring firmware bug class appears in **fragmented blob/model/configuration downloads**:[[8]](#references) 1. The **first fragment** (`offset == 0`) stores `ctx->total_size` and allocates `malloc(total_size)`. 2. Later fragments only validate the attacker-controlled **packet-local** fields such as `packet_total_size >= offset + chunk_len`. @@ -387,7 +387,7 @@ When the vulnerable path sits behind commissioning logic, exploitation must incl ### Protocol-driven `free()` triggers -In embedded daemons, the easiest way to trigger heap metadata exploitation is often not "wait for cleanup" but **force the protocol's own error handling**: +In embedded daemons, the easiest way to trigger heap metadata exploitation is often not "wait for cleanup" but **force the protocol's own error handling**:[[8]](#references) - Send malformed follow-up fragments to push the FSM into **retry** or **error** states. - Exceed the retry threshold so the daemon **resets context** and frees the corrupted buffer. @@ -401,7 +401,7 @@ Developing a PoC for identified vulnerabilities requires a deep understanding of ### uClibc fastbin exploitation notes (embedded Linux) -- **Fastbins + consolidation:** uClibc uses fastbins similar to glibc. A later large allocation can trigger `__malloc_consolidate()`, so any fake chunk must survive checks (sane size, `fd = 0`, and surrounding chunks seen as "in use"). +- **Fastbins + consolidation:** uClibc uses fastbins similar to glibc. A later large allocation can trigger `__malloc_consolidate()`, so any fake chunk must survive checks (sane size, `fd = 0`, and surrounding chunks seen as "in use").[[6]](#references) - **Non-PIE binaries under ASLR:** if ASLR is enabled but the main binary is **non-PIE**, in-binary `.data/.bss` addresses are stable. You can target a region that already resembles a valid heap chunk header to land a fastbin allocation on a **function pointer table**. - **Parser-stopping NUL:** when JSON is parsed, a `\x00` in the payload can stop parsing while keeping trailing attacker-controlled bytes for a stack pivot/ROP chain. - **Shellcode via `/proc/self/mem`:** a ROP chain that calls `open("/proc/self/mem")`, `lseek()`, and `write()` can plant executable shellcode in a known mapping and jump to it. @@ -417,7 +417,7 @@ Operating systems like [AttifyOS](https://github.com/adi0x90/attifyos) and [Embe ## Firmware Downgrade Attacks & Insecure Update Mechanisms -Even when a vendor implements cryptographic signature checks for firmware images, **version rollback (downgrade) protection is frequently omitted**. When the boot- or recovery-loader only verifies the signature with an embedded public key but does not compare the *version* (or a monotonic counter) of the image being flashed, an attacker can legitimately install an **older, vulnerable firmware that still bears a valid signature** and thus re-introduce patched vulnerabilities. +Even when a vendor implements cryptographic signature checks for firmware images, **version rollback (downgrade) protection is frequently omitted**. When the boot- or recovery-loader only verifies the signature with an embedded public key but does not compare the *version* (or a monotonic counter) of the image being flashed, an attacker can legitimately install an **older, vulnerable firmware that still bears a valid signature** and thus re-introduce patched vulnerabilities.[[4]](#references) Typical attack workflow: @@ -440,11 +440,11 @@ Content-Type: application/octet-stream Content-Length: 0 ``` -In the vulnerable (downgraded) firmware, the `md5` parameter is concatenated directly into a shell command without sanitisation, allowing injection of arbitrary commands (here – enabling SSH key-based root access). Later firmware versions introduced a basic character filter, but the absence of downgrade protection renders the fix moot. +In the vulnerable (downgraded) firmware, the `md5` parameter is concatenated directly into a shell command without sanitisation, allowing injection of arbitrary commands (here – enabling SSH key-based root access). Later firmware versions introduced a basic character filter, but the absence of downgrade protection renders the fix moot.[[4]](#references) ### Extracting Firmware From Mobile Apps -Many vendors bundle full firmware images inside their companion mobile applications so that the app can update the device over Bluetooth/Wi-Fi. These packages are commonly stored unencrypted in the APK/APEX under paths like `assets/fw/` or `res/raw/`. Tools such as `apktool`, `ghidra`, or even plain `unzip` allow you to pull signed images without touching the physical hardware. +Many vendors bundle full firmware images inside their companion mobile applications so that the app can update the device over Bluetooth/Wi-Fi. These packages are commonly stored unencrypted in the APK/APEX under paths like `assets/fw/` or `res/raw/`. Tools such as `apktool`, `ghidra`, or even plain `unzip` allow you to pull signed images without touching the physical hardware.[[4]](#references) ``` $ apktool d vendor-app.apk -o vendor-app @@ -454,7 +454,7 @@ firmware_v1.3.11.490_signed.bin ### Updater-only anti-rollback bypass in A/B slot designs -Some vendors do implement an anti-downgrade **ratchet**, but only inside the *updater* logic (for example a UDS routine over CAN, a recovery command, or a userspace OTA agent). If the **bootloader** later checks only the image signature/CRC and trusts the partition table or slot metadata, rollback protection can still be bypassed. +Some vendors do implement an anti-downgrade **ratchet**, but only inside the *updater* logic (for example a UDS routine over CAN, a recovery command, or a userspace OTA agent). If the **bootloader** later checks only the image signature/CRC and trusts the partition table or slot metadata, rollback protection can still be bypassed.[[7]](#references) Typical weak design: @@ -514,7 +514,7 @@ To practice discovering vulnerabilities in firmware, use the following vulnerabl ## Recovering firmware decryption keys from embedded KMS/Vault state -When an update image mixes small plaintext metadata with a large high-entropy blob, do container triage before brute-forcing anything: +When an update image mixes small plaintext metadata with a large high-entropy blob, do container triage before brute-forcing anything:[[1]](#references) - Dump headers, offsets and line boundaries with `hexdump`, `xxd`, `strings -tx`, `base64 -d`, and `binwalk -E`. - `Salted__` usually means OpenSSL `enc` format: the next 8 bytes are the salt and the remaining bytes are ciphertext. @@ -559,13 +559,13 @@ This turns "encrypted firmware" into a more general problem: **recover the appli ## References -- [Cracking Firmware with Claude: Senior-Level Skill, Junior-Level Autonomy](https://bishopfox.com/blog/cracking-firmware-with-claude-senior-level-skill-junior-level-autonomy) -- [https://scriptingxss.gitbook.io/firmware-security-testing-methodology/](https://scriptingxss.gitbook.io/firmware-security-testing-methodology/) -- [Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things](https://www.amazon.co.uk/Practical-IoT-Hacking-F-Chantzis/dp/1718500904) -- [Exploiting zero days in abandoned hardware – Trail of Bits blog](https://blog.trailofbits.com/2025/07/25/exploiting-zero-days-in-abandoned-hardware/) -- [How a $20 Smart Device Gave Me Access to Your Home](https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home) -- [Now You See mi: Now You're Pwned](https://labs.taszk.io/articles/post/nowyouseemi/) -- [Synacktiv - Exploiting the Tesla Wall Connector from its charge port connector - Part 2: bypassing the anti-downgrade](https://www.synacktiv.com/en/publications/exploiting-the-tesla-wall-connector-from-its-charge-port-connector-part-2-bypassing) -- [Make it Blink: Over-the-Air Exploitation of the Philips Hue Bridge](https://www.synacktiv.com/en/publications/make-it-blink-over-the-air-exploitation-of-the-philips-hue-bridge.html) +- [1] [Cracking Firmware with Claude: Senior-Level Skill, Junior-Level Autonomy](https://bishopfox.com/blog/cracking-firmware-with-claude-senior-level-skill-junior-level-autonomy) +- [2] [Firmware Security Testing Methodology](https://scriptingxss.gitbook.io/firmware-security-testing-methodology/) +- [3] [Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things](https://www.amazon.co.uk/Practical-IoT-Hacking-F-Chantzis/dp/1718500904) +- [4] [Exploiting zero days in abandoned hardware – Trail of Bits blog](https://blog.trailofbits.com/2025/07/25/exploiting-zero-days-in-abandoned-hardware/) +- [5] [How a $20 Smart Device Gave Me Access to Your Home](https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home) +- [6] [Now You See mi: Now You're Pwned](https://labs.taszk.io/articles/post/nowyouseemi/) +- [7] [Synacktiv - Exploiting the Tesla Wall Connector from its charge port connector - Part 2: bypassing the anti-downgrade](https://www.synacktiv.com/en/publications/exploiting-the-tesla-wall-connector-from-its-charge-port-connector-part-2-bypassing) +- [8] [Make it Blink: Over-the-Air Exploitation of the Philips Hue Bridge](https://www.synacktiv.com/en/publications/make-it-blink-over-the-air-exploitation-of-the-philips-hue-bridge.html) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/hardware-physical-access/firmware-analysis/android-mediatek-secure-boot-bl2_ext-bypass-el3.md b/src/hardware-physical-access/firmware-analysis/android-mediatek-secure-boot-bl2_ext-bypass-el3.md index 690414e5583..055f945abe8 100644 --- a/src/hardware-physical-access/firmware-analysis/android-mediatek-secure-boot-bl2_ext-bypass-el3.md +++ b/src/hardware-physical-access/firmware-analysis/android-mediatek-secure-boot-bl2_ext-bypass-el3.md @@ -2,7 +2,7 @@ {{#include ../../banners/hacktricks-training.md}} -This page documents a practical secure-boot break on multiple MediaTek platforms by abusing a verification gap when the device bootloader configuration (seccfg) is "unlocked". The flaw allows running a patched bl2_ext at ARM EL3 to disable downstream signature verification, collapsing the chain of trust and enabling arbitrary unsigned TEE/GZ/LK/Kernel loading. +This page documents a practical secure-boot break on multiple MediaTek platforms by abusing a verification gap when the device bootloader configuration (seccfg) is "unlocked". The flaw allows running a patched bl2_ext at ARM EL3 to disable downstream signature verification, collapsing the chain of trust and enabling arbitrary unsigned TEE/GZ/LK/Kernel loading.[[1]](#references) > Caution: Early-boot patching can permanently brick devices if offsets are wrong. Always keep full dumps and a reliable recovery path. @@ -12,26 +12,26 @@ This page documents a practical secure-boot break on multiple MediaTek platforms - Vulnerable path: When seccfg is set to unlocked, Preloader may skip verifying bl2_ext. Preloader still jumps into bl2_ext at EL3, so a crafted bl2_ext can load unverified components thereafter. Key trust boundary: -- bl2_ext executes at EL3 and is responsible for verifying TEE, GenieZone, LK/AEE and the kernel. If bl2_ext itself is not authenticated, the rest of the chain is trivially bypassed. +- bl2_ext executes at EL3 and is responsible for verifying TEE, GenieZone, LK/AEE and the kernel. If bl2_ext itself is not authenticated, the rest of the chain is trivially bypassed.[[1]](#references) ## Root cause On affected devices, the Preloader does not enforce authentication of the bl2_ext partition when seccfg indicates an "unlocked" state. This allows flashing an attacker-controlled bl2_ext that runs at EL3. -Inside bl2_ext, the verification policy function can be patched to unconditionally report that verification is not required (or always succeeds), forcing the boot chain to accept unsigned TEE/GZ/LK/Kernel images. Because this patch runs at EL3, it is effective even if downstream components implement their own checks. +Inside bl2_ext, the verification policy function can be patched to unconditionally report that verification is not required (or always succeeds), forcing the boot chain to accept unsigned TEE/GZ/LK/Kernel images. Because this patch runs at EL3, it is effective even if downstream components implement their own checks.[[1]](#references) ## Practical exploit chain 1. Obtain bootloader partitions (Preloader, bl2_ext, LK/AEE, etc.) via OTA/firmware packages, EDL/DA readback, or hardware dumping. 2. Identify bl2_ext verification routine and patch it to always skip/accept verification. 3. Flash modified bl2_ext using fastboot, DA, or similar maintenance channels that are still allowed on unlocked devices. -4. Reboot; Preloader jumps to patched bl2_ext at EL3 which then loads unsigned downstream images (patched TEE/GZ/LK/Kernel) and disables signature enforcement. +4. Reboot; Preloader jumps to patched bl2_ext at EL3 which then loads unsigned downstream images (patched TEE/GZ/LK/Kernel) and disables signature enforcement.[[1]](#references) If the device is configured as locked (seccfg locked), the Preloader is expected to verify bl2_ext. In that configuration, this attack will fail unless another vulnerability permits loading an unsigned bl2_ext. ## Triage (expdb boot logs) -- Dump boot/expdb logs around the bl2_ext load. If `img_auth_required = 0` and certificate verification time is ~0 ms, verification is likely skipped. +- Dump boot/expdb logs around the bl2_ext load. If `img_auth_required = 0` and certificate verification time is ~0 ms, verification is likely skipped.[[1]](#references) Example log excerpt: @@ -41,22 +41,22 @@ Example log excerpt: [PART] part: lk_a img: bl2_ext cert vfy(0 ms) ``` -- Some devices skip bl2_ext verification even when locked; lk2 secondary bootloader paths have shown the same gap. If a post-OTA Preloader logs `img_auth_required = 1` for bl2_ext while unlocked, enforcement was likely restored. +- Some devices skip bl2_ext verification even when locked; lk2 secondary bootloader paths have shown the same gap. If a post-OTA Preloader logs `img_auth_required = 1` for bl2_ext while unlocked, enforcement was likely restored.[[1]](#references)[[2]](#references) ## Verification logic locations - The relevant check typically resides inside the bl2_ext image in functions named similarly to `verify_img` or `sec_img_auth`. -- The patched version forces the function to return success or to bypass the verification call entirely. +- The patched version forces the function to return success or to bypass the verification call entirely.[[1]](#references) Example patch approach (conceptual): - Locate the function that calls `sec_img_auth` on TEE, GZ, LK, and kernel images. - Replace its body with a stub that immediately returns success, or overwrite the conditional branch that handles verification failure. -Ensure the patch preserves stack/frame setup and returns expected status codes to callers. +Ensure the patch preserves stack/frame setup and returns expected status codes to callers.[[1]](#references) ## Fenrir PoC workflow (Nothing/CMF) -Fenrir is a reference patching toolkit for this issue (Nothing Phone (2a) fully supported; CMF Phone 1 partially). High level: +Fenrir is a reference patching toolkit for this issue (Nothing Phone (2a) fully supported; CMF Phone 1 partially).[[1]](#references) High level: - Place the device bootloader image as `bin/.bin`. - Build a patched image that disables the bl2_ext verification policy. - Flash the resulting payload (fastboot helper provided). @@ -73,24 +73,24 @@ Use another flashing channel if fastboot is unavailable. - bl2_ext executes in ARM EL3. Crashes here can brick a device until reflashed via EDL/DA or test points. - Use board-specific logging/UART to validate execution path and diagnose crashes. -- Keep backups of all partitions being modified and test on disposable hardware first. +- Keep backups of all partitions being modified and test on disposable hardware first.[[1]](#references) ## Implications - EL3 code execution after Preloader and full chain-of-trust collapse for the rest of the boot path. -- Ability to boot unsigned TEE/GZ/LK/Kernel, bypassing secure/verified boot expectations and enabling persistent compromise. +- Ability to boot unsigned TEE/GZ/LK/Kernel, bypassing secure/verified boot expectations and enabling persistent compromise.[[1]](#references) ## Device notes - Confirmed supported: Nothing Phone (2a) (Pacman) - Known working (incomplete support): CMF Phone 1 (Tetris) -- Observed: Vivo X80 Pro reportedly did not verify bl2_ext even when locked -- NothingOS 4 stable (BP2A.250605.031.A3, Nov 2025) re-enabled bl2_ext verification; fenrir `pacman-v2.0` restores the bypass by mixing the beta Preloader with a patched LK -- Industry coverage highlights additional lk2-based vendors shipping the same logic flaw, so expect further overlap across 2024–2025 MTK releases. +- Observed: Vivo X80 Pro reportedly did not verify bl2_ext even when locked[[1]](#references) +- NothingOS 4 stable (BP2A.250605.031.A3, Nov 2025) re-enabled bl2_ext verification; fenrir `pacman-v2.0` restores the bypass by mixing the beta Preloader with a patched LK[[3]](#references) +- Industry coverage highlights additional lk2-based vendors shipping the same logic flaw, so expect further overlap across 2024–2025 MTK releases.[[2]](#references)[[4]](#references) ## MTK DA readback and seccfg manipulation with Penumbra -Penumbra is a Rust crate/CLI/TUI that automates interaction with MTK preloader/bootrom over USB for DA-mode operations. With physical access to a vulnerable handset (DA extensions allowed), it can discover the MTK USB port, load a Download Agent (DA) blob, and issue privileged commands such as seccfg lock flipping and partition readback. +Penumbra is a Rust crate/CLI/TUI that automates interaction with MTK preloader/bootrom over USB for DA-mode operations. With physical access to a vulnerable handset (DA extensions allowed), it can discover the MTK USB port, load a Download Agent (DA) blob, and issue privileged commands such as seccfg lock flipping and partition readback.[[5]](#references) - **Environment/driver setup**: On Linux install `libudev`, add the user to the `dialout` group, and create udev rules or run with `sudo` if the device node is not accessible. Windows support is unreliable; it sometimes works only after replacing the MTK driver with WinUSB using Zadig (per project guidance). - **Workflow**: Read a DA payload (e.g., `std::fs::read("../DA_penangf.bin")`), poll for the MTK port with `find_mtk_port()`, and build a session using `DeviceBuilder::with_mtk_port(...).with_da_data(...)`. After `init()` completes the handshake and gathers device info, check protections via `dev_info.target_config()` bitfields (bit 0 set → SBC enabled). Enter DA mode and attempt `set_seccfg_lock_state(LockFlag::Unlock)`—this only succeeds if the device accepts extensions. Partitions can be dumped with `read_partition("lk_a", &mut progress_cb, &mut writer)` for offline analysis or patching. @@ -136,10 +136,10 @@ async fn main() -> Result<()> { ## References -- [Fenrir – MediaTek bl2_ext secure‑boot bypass (PoC)](https://github.com/R0rt1z2/fenrir) -- [Cyber Security News – PoC Exploit Released For Nothing Phone Code Execution Vulnerability](https://cybersecuritynews.com/nothing-phone-code-execution-vulnerability/) -- [Fenrir pacman-v2.0 release (NothingOS 4 bypass bundle)](https://github.com/R0rt1z2/fenrir/releases/tag/pacman-v2.0) -- [The Cyber Express – Fenrir PoC breaks secure boot on Nothing Phone 2a/CMF1](https://thecyberexpress.com/fenrir-poc-for-nothing-phone-2a-cmf1/) -- [Penumbra – MTK DA flash/readback & seccfg tooling](https://github.com/shomykohai/penumbra) +- [1] [Fenrir – MediaTek bl2_ext secure‑boot bypass (PoC)](https://github.com/R0rt1z2/fenrir) +- [2] [Cyber Security News – PoC Exploit Released For Nothing Phone Code Execution Vulnerability](https://cybersecuritynews.com/nothing-phone-code-execution-vulnerability/) +- [3] [Fenrir pacman-v2.0 release (NothingOS 4 bypass bundle)](https://github.com/R0rt1z2/fenrir/releases/tag/pacman-v2.0) +- [4] [The Cyber Express – Fenrir PoC breaks secure boot on Nothing Phone 2a/CMF1](https://thecyberexpress.com/fenrir-poc-for-nothing-phone-2a-cmf1/) +- [5] [Penumbra – MTK DA flash/readback & seccfg tooling](https://github.com/shomykohai/penumbra) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/hardware-physical-access/firmware-analysis/bootloader-testing.md b/src/hardware-physical-access/firmware-analysis/bootloader-testing.md index 609b03cb401..7015cbf0ab5 100644 --- a/src/hardware-physical-access/firmware-analysis/bootloader-testing.md +++ b/src/hardware-physical-access/firmware-analysis/bootloader-testing.md @@ -13,7 +13,7 @@ android-mediatek-secure-boot-bl2_ext-bypass-el3.md ## U-Boot quick wins and environment abuse 1. Access the interpreter shell - - During boot, hit a known break key (often any key, 0, space, or a board-specific "magic" sequence) before `bootcmd` executes to drop to the U-Boot prompt. + - During boot, hit a known break key (often any key, 0, space, or a board-specific "magic" sequence) before `bootcmd` executes to drop to the U-Boot prompt.[[1]](#references) 2. Inspect boot state and variables - Useful commands: @@ -64,7 +64,7 @@ android-mediatek-secure-boot-bl2_ext-bypass-el3.md ``` - Absence of `CONFIG_FIT_SIGNATURE`/`CONFIG_(SPL_)FIT_SIGNATURE` or legacy `verify=n` behavior often allows booting arbitrary payloads. - Don’t stop at a simple allow/deny result: recent FIT research showed that the verification path itself can be a pre-auth attack surface. Negative-test externally stored FIT data (`data-offset`, `data-position`, `data-size`), signed configuration selection, `loadables`, and overlay / `extra-conf` handling. - - If you have a matching source tree, `test/vboot/vboot_test.sh` is a fast way to reproduce FIT verification behaviour in U-Boot sandbox before touching real hardware. + - If you have a matching source tree, `test/vboot/vboot_test.sh` is a fast way to reproduce FIT verification behaviour in U-Boot sandbox before touching real hardware.[[10]](#references) 8. Standard Boot (`bootstd`), `extlinux`, and script bootflows - On modern U-Boot builds, `bootcmd` is often just a wrapper around Standard Boot. That means writable media, PXE, or SPI flash can become the real trust boundary even when the visible environment looks harmless. @@ -83,7 +83,7 @@ android-mediatek-secure-boot-bl2_ext-bypass-el3.md ## Network-boot surface (DHCP/PXE) and rogue servers 9. PXE/DHCP parameter fuzzing - - U-Boot’s legacy BOOTP/DHCP handling has had memory-safety issues. For example, CVE‑2024‑42040 describes memory disclosure via crafted DHCP responses that can leak bytes from U-Boot memory back on the wire. Exercise the DHCP/PXE code paths with overly long/edge-case values (option 67 bootfile-name, vendor options, file/servername fields) and observe for hangs/leaks. + - U-Boot’s legacy BOOTP/DHCP handling has had memory-safety issues. For example, CVE‑2024‑42040 describes memory disclosure via crafted DHCP responses that can leak bytes from U-Boot memory back on the wire.[[4]](#references) Exercise the DHCP/PXE code paths with overly long/edge-case values (option 67 bootfile-name, vendor options, file/servername fields) and observe for hangs/leaks. - Minimal Scapy snippet to stress boot parameters during netboot: ```python from scapy.all import * @@ -132,11 +132,11 @@ Assess whether the device has secure-boot eFuses/OTP burned. If not, BootROM dow efi-readvar -v db efi-readvar -v dbx ``` - - If the platform is in Setup Mode, accepts unauthenticated key enrollment, or ships with a test/default Platform Key (PKfail class), a local admin or physical attacker can enroll their own KEK/db and keep Secure Boot looking “enabled” while booting arbitrary EFI binaries. + - If the platform is in Setup Mode, accepts unauthenticated key enrollment, or ships with a test/default Platform Key (PKfail class), a local admin or physical attacker can enroll their own KEK/db and keep Secure Boot looking “enabled” while booting arbitrary EFI binaries.[[3]](#references) - Try booting with downgraded or known-vulnerable signed boot components if Secure Boot revocations (dbx) aren’t current. If the platform still trusts old shims/bootmanagers, you can often load your own kernel or `grub.cfg` from the ESP to gain persistence. 12. Stale shim / SBAT / dbx revocation testing - - Old Microsoft-signed shims and vendor forks can still act as a BYOVD-style bootkit path if revocations are stale. In an isolated lab, place a historically vulnerable shim on the ESP and attempt to chainload your own `grubx64.efi` or kernel. + - Old Microsoft-signed shims and vendor forks can still act as a BYOVD-style bootkit path if revocations are stale. In an isolated lab, place a historically vulnerable shim on the ESP and attempt to chainload your own `grubx64.efi` or kernel.[[11]](#references) - Quick triage: ```bash sbverify --list shimx64.efi @@ -146,27 +146,27 @@ Assess whether the device has secure-boot eFuses/OTP burned. If not, BootROM dow - If the shim still runs despite being on the revocation list, the firmware/OS has stale `dbx` updates or trusts a forked loader that never inherited upstream SBAT protections. 13. Boot logo parsing bugs (LogoFAIL class) - - Several OEM/IBV firmwares were vulnerable to image-parsing flaws in DXE that process boot logos. If an attacker can place a crafted image on the ESP under a vendor-specific path (e.g., `\EFI\\logo\*.bmp`) and reboot, code execution during early boot may be possible even with Secure Boot enabled. Test whether the platform accepts user-supplied logos and whether those paths are writable from the OS. + - Several OEM/IBV firmwares were vulnerable to image-parsing flaws in DXE that process boot logos. If an attacker can place a crafted image on the ESP under a vendor-specific path (e.g., `\EFI\\logo\*.bmp`) and reboot, code execution during early boot may be possible even with Secure Boot enabled. Test whether the platform accepts user-supplied logos and whether those paths are writable from the OS.[[2]](#references) ## Android/Qualcomm ABL + GBL (Android 16) trust gaps -On Android 16 devices that use Qualcomm's ABL to load the **Generic Bootloader Library (GBL)**, validate whether ABL **authenticates** the UEFI app it loads from the `efisp` partition. If ABL only checks for a UEFI app **presence** and does not verify signatures, a write primitive to `efisp` becomes **pre-OS unsigned code execution** at boot. +On Android 16 devices that use Qualcomm's ABL to load the **Generic Bootloader Library (GBL)**, validate whether ABL **authenticates** the UEFI app it loads from the `efisp` partition. If ABL only checks for a UEFI app **presence** and does not verify signatures, a write primitive to `efisp` becomes **pre-OS unsigned code execution** at boot.[[6]](#references)[[7]](#references) Practical checks and abuse paths: -- **efisp write primitive**: You need a way to write a custom UEFI app into `efisp` (root/privileged service, OEM app bug, recovery/fastboot path). Without this, the GBL loading gap is not directly reachable. +- **efisp write primitive**: You need a way to write a custom UEFI app into `efisp` (root/privileged service, OEM app bug, recovery/fastboot path). Without this, the GBL loading gap is not directly reachable.[[6]](#references) - **fastboot OEM argument injection** (ABL bug): Some builds accept extra tokens in `fastboot oem set-gpu-preemption` and append them to the kernel cmdline. This can be used to force permissive SELinux, enabling protected partition writes: ```bash fastboot oem set-gpu-preemption 0 androidboot.selinux=permissive ``` - If the device is patched, the command should reject extra arguments. -- **Bootloader unlock via persistent flags**: A boot-stage payload can flip persistent unlock flags (e.g., `is_unlocked=1`, `is_unlocked_critical=1`) to emulate `fastboot oem unlock` without OEM server/approval gates. This is a durable posture change after the next reboot. + If the device is patched, the command should reject extra arguments.[[5]](#references)[[6]](#references) +- **Bootloader unlock via persistent flags**: A boot-stage payload can flip persistent unlock flags (e.g., `is_unlocked=1`, `is_unlocked_critical=1`) to emulate `fastboot oem unlock` without OEM server/approval gates. This is a durable posture change after the next reboot.[[6]](#references) Defensive/triage notes: - Confirm whether ABL performs signature verification on the GBL/UEFI payload from `efisp`. If not, treat `efisp` as a high‑risk persistence surface. -- Track whether ABL fastboot OEM handlers are patched to **validate argument counts** and reject additional tokens. +- Track whether ABL fastboot OEM handlers are patched to **validate argument counts** and reject additional tokens.[[8]](#references)[[9]](#references) ## Hardware caution @@ -181,14 +181,16 @@ Be cautious when interacting with SPI/NAND flash during early boot (e.g., ground ## References -- [https://scriptingxss.gitbook.io/firmware-security-testing-methodology/](https://scriptingxss.gitbook.io/firmware-security-testing-methodology/) -- [https://www.binarly.io/blog/finding-logofail-the-dangers-of-image-parsing-during-system-boot](https://www.binarly.io/blog/finding-logofail-the-dangers-of-image-parsing-during-system-boot) -- [https://nvd.nist.gov/vuln/detail/CVE-2024-42040](https://nvd.nist.gov/vuln/detail/CVE-2024-42040) -- [https://www.androidauthority.com/qualcomm-snapdragon-8-elite-gbl-exploit-bootloader-unlock-3648651/](https://www.androidauthority.com/qualcomm-snapdragon-8-elite-gbl-exploit-bootloader-unlock-3648651/) -- [https://bestwing.me/preempted-unlocking-xiaomi-via-two-unsanitized-strings.html](https://bestwing.me/preempted-unlocking-xiaomi-via-two-unsanitized-strings.html) -- [https://source.android.com/docs/core/architecture/bootloader/generic-bootloader](https://source.android.com/docs/core/architecture/bootloader/generic-bootloader) -- [https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/f09c2fe3d6c42660587460e31be50c18c8c777ab](https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/f09c2fe3d6c42660587460e31be50c18c8c777ab) -- [https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/78297e8cfe091fc59c42fc33d3490e2008910fe2](https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/78297e8cfe091fc59c42fc33d3490e2008910fe2) -- [https://www.binarly.io/blog/unfit-to-boot-breaking-u-boots-fit-signature-verification](https://www.binarly.io/blog/unfit-to-boot-breaking-u-boots-fit-signature-verification) -- [https://kb.cert.org/vuls/id/616257](https://kb.cert.org/vuls/id/616257) +- [1] [Firmware Security Testing Methodology](https://scriptingxss.gitbook.io/firmware-security-testing-methodology/) +- [2] [Finding LogoFAIL: The dangers of image parsing during system boot](https://www.binarly.io/blog/finding-logofail-the-dangers-of-image-parsing-during-system-boot) +- [3] [PKfail: Untrusted Platform Keys Undermine Secure Boot on UEFI Ecosystem](https://www.binarly.io/blog/pkfail-untrusted-platform-keys-undermine-secure-boot-on-uefi-ecosystem) +- [4] [CVE-2024-42040 Detail](https://nvd.nist.gov/vuln/detail/CVE-2024-42040) +- [5] [Preempted: Unlocking Xiaomi via two unsanitized strings](https://bestwing.me/preempted-unlocking-xiaomi-via-two-unsanitized-strings.html) +- [6] [Qualcomm Snapdragon 8 Elite GBL exploit lets attackers unlock bootloaders](https://www.androidauthority.com/qualcomm-snapdragon-8-elite-gbl-exploit-bootloader-unlock-3648651/) +- [7] [Generic Bootloader (GBL) architecture](https://source.android.com/docs/core/architecture/bootloader/generic-bootloader) +- [8] [QcomModulePkg: Fix propagation of untrusted input into kernel cmdline](https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/f09c2fe3d6c42660587460e31be50c18c8c777ab) +- [9] [QcomModulePkg: add check for set-hw-fence-value command](https://git.codelinaro.org/clo/la/abl/tianocore/edk2/-/commit/78297e8cfe091fc59c42fc33d3490e2008910fe2) +- [10] [Unfit to boot: breaking U-Boot's FIT signature verification](https://www.binarly.io/blog/unfit-to-boot-breaking-u-boots-fit-signature-verification) +- [11] [Vulnerability Note VU#616257 - Microsoft-signed UEFI shim bootloaders vulnerable to Secure Boot bypass](https://kb.cert.org/vuls/id/616257) + {{#include ../../banners/hacktricks-training.md}} diff --git a/src/hardware-physical-access/firmware-analysis/firmware-integrity.md b/src/hardware-physical-access/firmware-analysis/firmware-integrity.md index 0b4f9794b39..85be97ef44b 100644 --- a/src/hardware-physical-access/firmware-analysis/firmware-integrity.md +++ b/src/hardware-physical-access/firmware-analysis/firmware-integrity.md @@ -26,7 +26,7 @@ If a root shell has already been obtained through dynamic analysis, bootloader m ## Unauthenticated transport bridges to privileged update protocols -A common embedded design mistake is exposing the **same internal command protocol over several transports** but enforcing authentication on only one of them. For example, USB may require challenge-response while BLE simply forwards unauthenticated **GATT writes** into the same privileged firmware-update handler. +A common embedded design mistake is exposing the **same internal command protocol over several transports** but enforcing authentication on only one of them. For example, USB may require challenge-response while BLE simply forwards unauthenticated **GATT writes** into the same privileged firmware-update handler.[[1]](#references) Typical offensive workflow: @@ -57,7 +57,7 @@ Things to verify while reversing: ## Checksum-only firmware containers are still attacker-controlled firmware -A firmware container protected only by an **unkeyed checksum** (CRC32, SHA-256, MD5, etc.) provides corruption detection, **not authenticity**. If the attacker can reach the update routine, they can patch the image, recompute the checksum, and flash arbitrary code. +A firmware container protected only by an **unkeyed checksum** (CRC32, SHA-256, MD5, etc.) provides corruption detection, **not authenticity**. If the attacker can reach the update routine, they can patch the image, recompute the checksum, and flash arbitrary code.[[1]](#references) Red flags during RE: @@ -78,7 +78,7 @@ If this works over a remotely reachable transport such as BLE/Wi-Fi, the bug is ## Turning a trusted USB peripheral into BadUSB via firmware reflashing -When the target device is already trusted by the host over USB, malicious firmware may not need to implement a full new USB stack. A much easier pivot is often to **reuse existing HID support**. +When the target device is already trusted by the host over USB, malicious firmware may not need to implement a full new USB stack. A much easier pivot is often to **reuse existing HID support**.[[1]](#references) Useful pattern: @@ -99,7 +99,7 @@ This turns firmware compromise into **host compromise** because the PC will trus ## Reliable payload execution inside RTOS firmware -Instead of inserting fragile trampolines into random code paths, look for **existing RTOS tasks** that are unused or low-impact in normal operation. +Instead of inserting fragile trampolines into random code paths, look for **existing RTOS tasks** that are unused or low-impact in normal operation.[[1]](#references) Why this is useful: @@ -111,7 +111,7 @@ Good targets are diagnostic, factory-test, telemetry, or coprocessor service tas ## Fast exploit iteration: repurpose benign protocol handlers -Once firmware patching is possible, a compact way to accelerate RE is to overwrite a harmless command handler (for example an **echo/debug opcode**) with custom **memory read / write / execute** primitives. This avoids full reflashing for every experiment and is especially useful when the device supports the modified handler over a fast wired transport. +Once firmware patching is possible, a compact way to accelerate RE is to overwrite a harmless command handler (for example an **echo/debug opcode**) with custom **memory read / write / execute** primitives. This avoids full reflashing for every experiment and is especially useful when the device supports the modified handler over a fast wired transport.[[1]](#references) Use this to: @@ -122,6 +122,6 @@ Use this to: ## References -- [Pwnd Blaster: Hacking your PC using your speaker without ever touching it](https://blog.nns.ee/2026/06/03/katana-badusb/) +- [1] [Pwnd Blaster: Hacking your PC using your speaker without ever touching it](https://blog.nns.ee/2026/06/03/katana-badusb/) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/containers-namespaces/container-security/protections/selinux.md b/src/linux-hardening/containers-namespaces/container-security/protections/selinux.md index b04284a3657..3fd263ac638 100644 --- a/src/linux-hardening/containers-namespaces/container-security/protections/selinux.md +++ b/src/linux-hardening/containers-namespaces/container-security/protections/selinux.md @@ -42,13 +42,13 @@ On an SELinux-enabled host, this is a very practical demonstration because it sh ## Runtime Usage -Podman is particularly well aligned with SELinux on systems where SELinux is part of the platform default. Rootless Podman plus SELinux is one of the strongest mainstream container baselines because the process is already unprivileged on the host side and is still confined by MAC policy. Docker can also use SELinux where supported, although administrators sometimes disable it to work around volume-labeling friction. CRI-O and OpenShift rely heavily on SELinux as part of their container isolation story. Kubernetes can expose SELinux-related settings too, but their value obviously depends on whether the node OS actually supports and enforces SELinux. +Podman is particularly well aligned with SELinux on systems where SELinux is part of the platform default. Rootless Podman plus SELinux is one of the strongest mainstream container baselines because the process is already unprivileged on the host side and is still confined by MAC policy. Docker can also use SELinux where supported, although administrators sometimes disable it to work around volume-labeling friction. CRI-O and OpenShift rely heavily on SELinux as part of their container isolation story. Kubernetes can expose SELinux-related settings too, but their value obviously depends on whether the node OS actually supports and enforces SELinux.[[2]](#references) The recurring lesson is that SELinux is not an optional garnish. In the ecosystems that are built around it, it is part of the expected security boundary. ## Misconfigurations -The classic mistake is `label=disable`. Operationally, this often happens because a volume mount was denied and the quickest short-term answer was to remove SELinux from the equation instead of fixing the labeling model. Another common mistake is incorrect relabeling of host content. Broad relabel operations may make the application work, but they can also expand what the container is allowed to touch far beyond what was originally intended. +The classic mistake is `label=disable`. Operationally, this often happens because a volume mount was denied and the quickest short-term answer was to remove SELinux from the equation instead of fixing the labeling model.[[1]](#references) Another common mistake is incorrect relabeling of host content. Broad relabel operations may make the application work, but they can also expand what the container is allowed to touch far beyond what was originally intended. It is also important not to confuse **installed** SELinux with **effective** SELinux. A host may support SELinux and still be in permissive mode, or the runtime may not be launching the workload under the expected domain. In those cases the protection is much weaker than the documentation might suggest. @@ -151,4 +151,10 @@ When reviewing a container on an SELinux-capable platform, do not treat labeling | CRI-O / OpenShift style deployments | Commonly relied on heavily | SELinux is often a core part of the node isolation model in these environments | custom policies that over-broaden access, disabling labeling for compatibility | SELinux defaults are more distribution-dependent than seccomp defaults. On Fedora/RHEL/OpenShift-style systems, SELinux is often central to the isolation model. On non-SELinux systems, it is simply absent. + +## References + +- [1] [Podman Documentation: --security-opt=option (label=disable)](https://docs.podman.io/en/v4.6.0/markdown/options/security-opt.html) +- [2] [Kubernetes: Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) + {{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/containers-namespaces/container-security/runtime-api-and-daemon-exposure.md b/src/linux-hardening/containers-namespaces/container-security/runtime-api-and-daemon-exposure.md index 2313e863000..2cfff707999 100644 --- a/src/linux-hardening/containers-namespaces/container-security/runtime-api-and-daemon-exposure.md +++ b/src/linux-hardening/containers-namespaces/container-security/runtime-api-and-daemon-exposure.md @@ -226,4 +226,5 @@ What is interesting here: - [1] [containerd socket exploitation part 1](https://thegreycorner.com/2025/02/12/containerd-socket-exploitation-part-1.html) - [2] [Kubernetes API Server Bypass Risks](https://kubernetes.io/docs/concepts/security/api-server-bypass-risks/) + {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/containers-namespaces/container-security/runtimes-and-engines.md b/src/linux-hardening/containers-namespaces/container-security/runtimes-and-engines.md index 10b3047edca..5b4b167b3ba 100644 --- a/src/linux-hardening/containers-namespaces/container-security/runtimes-and-engines.md +++ b/src/linux-hardening/containers-namespaces/container-security/runtimes-and-engines.md @@ -88,7 +88,7 @@ That is why one of the first steps in container assessment should always be to a Not every container escape comes from operator misconfiguration. Sometimes the runtime itself is the vulnerable component. This matters because a workload may be running with what looks like a careful configuration and still be exposed through a low-level runtime flaw. -The classic example is **CVE-2019-5736** in `runc`, where a malicious container could overwrite the host `runc` binary and then wait for a later `docker exec` or similar runtime invocation to trigger attacker-controlled code. The exploit path is very different from a simple bind-mount or capability mistake because it abuses how the runtime re-enters the container process space during exec handling. +The classic example is **CVE-2019-5736** in `runc`, where a malicious container could overwrite the host `runc` binary and then wait for a later `docker exec` or similar runtime invocation to trigger attacker-controlled code. The exploit path is very different from a simple bind-mount or capability mistake because it abuses how the runtime re-enters the container process space during exec handling.[[1]](#references) A minimal reproduction workflow from a red-team perspective is: @@ -106,4 +106,9 @@ docker exec -it /bin/sh The key lesson is not the exact historical exploit implementation, but the assessment implication: if the runtime version is vulnerable, ordinary in-container code execution may be enough to compromise the host even when the visible container configuration does not look blatantly weak. Recent runtime CVEs such as `CVE-2024-21626` in `runc`, BuildKit mount races, and containerd parsing bugs reinforce the same point. Runtime version and patch level are part of the security boundary, not merely maintenance trivia. + +## References + +- [1] [Breaking out of Docker via runC – Explaining CVE-2019-5736](https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/) + {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/containers-namespaces/container-security/sensitive-host-mounts.md b/src/linux-hardening/containers-namespaces/container-security/sensitive-host-mounts.md index 3c95b188f76..dad8d2e2050 100644 --- a/src/linux-hardening/containers-namespaces/container-security/sensitive-host-mounts.md +++ b/src/linux-hardening/containers-namespaces/container-security/sensitive-host-mounts.md @@ -280,7 +280,6 @@ echo "wait for the next pod scheduled on this node" This is not as immediate as a mounted `docker.sock`, but it is often more realistic in compromised Kubernetes infrastructure pods. The important point is that the modified binary is later executed by the host network setup flow, not by the current container. - ## Runtime Sockets Sensitive host mounts often include runtime sockets rather than full directories. These are so important that they deserve explicit repetition here: @@ -363,4 +362,5 @@ What is interesting here: - [1] [Local Files And Paths Used By The Kubelet](https://kubernetes.io/docs/reference/node/kubelet-files/) - [2] [cilium-agent container can access the host via `hostPath` mount](https://github.com/cilium/cilium/security/advisories/GHSA-4hc4-pgfx-3mrx) + {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/containers-namespaces/containerd-ctr-privilege-escalation.md b/src/linux-hardening/containers-namespaces/containerd-ctr-privilege-escalation.md index eaf47459804..4bfc63a8efc 100644 --- a/src/linux-hardening/containers-namespaces/containerd-ctr-privilege-escalation.md +++ b/src/linux-hardening/containers-namespaces/containerd-ctr-privilege-escalation.md @@ -6,7 +6,6 @@ Go to the following link to learn **where `containerd` and `ctr` fit in the container stack**: - {{#ref}} container-security/runtimes-and-engines.md {{#endref}} @@ -46,7 +45,6 @@ You can run a privileged container as: Then you can use some of the techniques mentioned in the following page to **escape from it abusing privileged capabilities**: - {{#ref}} container-security/ {{#endref}} diff --git a/src/linux-hardening/containers-namespaces/runc-privilege-escalation.md b/src/linux-hardening/containers-namespaces/runc-privilege-escalation.md index 12514ce625f..e54915fa990 100644 --- a/src/linux-hardening/containers-namespaces/runc-privilege-escalation.md +++ b/src/linux-hardening/containers-namespaces/runc-privilege-escalation.md @@ -6,7 +6,6 @@ If you want to learn more about **runc** check the following page: - {{#ref}} ../../network-services-pentesting/2375-pentesting-docker.md {{#endref}} @@ -43,5 +42,3 @@ runc run demo > This won't always work as the default operation of runc is to run as root, so running it as an unprivileged user simply cannot work (unless you have a rootless configuration). Making a rootless configuration the default isn't generally a good idea because there are quite a few restrictions inside rootless containers that don't apply outside rootless containers. {{#include ../../banners/hacktricks-training.md}} - - diff --git a/src/linux-hardening/interesting-files-permissions/ld.so.conf-example.md b/src/linux-hardening/interesting-files-permissions/ld.so.conf-example.md index 3f1f1b22141..78478c2b5a7 100644 --- a/src/linux-hardening/interesting-files-permissions/ld.so.conf-example.md +++ b/src/linux-hardening/interesting-files-permissions/ld.so.conf-example.md @@ -186,8 +186,6 @@ ldd sharedvuln **As you can see, having sudo privileges over `ldconfig` you can exploit the same vulnerability.** - - ## References - [1] [ld.so(8) - Linux manual page](https://man7.org/linux/man-pages/man8/ld.so.8.html) diff --git a/src/linux-hardening/interesting-files-permissions/linux-capabilities.md b/src/linux-hardening/interesting-files-permissions/linux-capabilities.md index eb5226026d6..1a33a0e8cb6 100644 --- a/src/linux-hardening/interesting-files-permissions/linux-capabilities.md +++ b/src/linux-hardening/interesting-files-permissions/linux-capabilities.md @@ -5,7 +5,7 @@ ## Linux Capabilities -Linux capabilities divide **root privileges into smaller, distinct units**, allowing processes to have a subset of privileges. This minimizes the risks by not granting full root privileges unnecessarily. +Linux capabilities divide **root privileges into smaller, distinct units**, allowing processes to have a subset of privileges. This minimizes the risks by not granting full root privileges unnecessarily.[[5]](#references) ### The Problem: @@ -17,7 +17,7 @@ Linux capabilities divide **root privileges into smaller, distinct units**, allo - **Purpose**: Determines the capabilities passed down from the parent process. - **Functionality**: When a new process is created, it inherits the capabilities from its parent in this set. Useful for maintaining certain privileges across process spawns. - - **Restrictions**: A process cannot gain capabilities that its parent did not possess. + - **Restrictions**: A process cannot gain capabilities that its parent did not possess.[[3]](#references) 2. **Effective (CapEff)**: @@ -57,7 +57,7 @@ def manage_capabilities(process): ### Processes Capabilities To see the capabilities for a particular process, use the **status** file in the /proc directory. As it provides more details, let’s limit it only to the information related to Linux capabilities.\ -Note that for all running processes capability information is maintained per thread, for binaries in the file system it’s stored in extended attributes. +Note that for all running processes capability information is maintained per thread, for binaries in the file system it’s stored in extended attributes.[[4]](#references) You can find the capabilities defined in /usr/include/linux/capability.h @@ -338,7 +338,7 @@ docker run --rm -it --cap-drop=ALL --cap-add=SYS_PTRACE r.j3ss.co/amicontained ## Privesc/Container Escape -Capabilities are useful when you **want to restrict your own processes after performing privileged operations** (e.g. after setting up chroot and binding to a socket). However, they can be exploited by passing them malicious commands or arguments which are then run as root. +Capabilities are useful when you **want to restrict your own processes after performing privileged operations** (e.g. after setting up chroot and binding to a socket). However, they can be exploited by passing them malicious commands or arguments which are then run as root.[[2]](#references) You can force capabilities upon programs using `setcap`, and query these using `getcap`: @@ -681,7 +681,7 @@ List **processes** running in the **host** `ps -eaf` ## CAP_SYS_MODULE -**[`CAP_SYS_MODULE`](https://man7.org/linux/man-pages/man7/capabilities.7.html)** empowers a process to **load and unload kernel modules (`init_module(2)`, `finit_module(2)` and `delete_module(2)` system calls)**, offering direct access to the kernel's core operations. This capability presents critical security risks, as it enables privilege escalation and total system compromise by allowing modifications to the kernel, thereby bypassing all Linux security mechanisms, including Linux Security Modules and container isolation. +**[`CAP_SYS_MODULE`](https://man7.org/linux/man-pages/man7/capabilities.7.html)** empowers a process to **load and unload kernel modules (`init_module(2)`, `finit_module(2)` and `delete_module(2)` system calls)**, offering direct access to the kernel's core operations. This capability presents critical security risks, as it enables privilege escalation and total system compromise by allowing modifications to the kernel, thereby bypassing all Linux security mechanisms, including Linux Security Modules and container isolation.[[6]](#references) **This means that you can** **insert/remove kernel modules in/from the kernel of the host machine.** **Example with binary** diff --git a/src/linux-hardening/interesting-files-permissions/nfs-no_root_squash-misconfiguration-pe.md b/src/linux-hardening/interesting-files-permissions/nfs-no_root_squash-misconfiguration-pe.md index 546c11223ee..25cbcf958cb 100644 --- a/src/linux-hardening/interesting-files-permissions/nfs-no_root_squash-misconfiguration-pe.md +++ b/src/linux-hardening/interesting-files-permissions/nfs-no_root_squash-misconfiguration-pe.md @@ -2,7 +2,6 @@ {{#include ../../banners/hacktricks-training.md}} - ## Squashing Basic Info NFS will usually (specially in linux) trust the indicated `uid` and `gid` by the client conencting to access the files (if kerberos is not used). However, there are some configurations that can be set in the server to **change this behavior**: @@ -15,7 +14,6 @@ In the **/etc/exports** file, if you find some directory that is configured as * For more information about **NFS** check: - {{#ref}} ../../network-services-pentesting/nfs-service-pentesting.md {{#endref}} @@ -146,5 +144,3 @@ drwxr-x--- 6 1008 1009 1024 Apr 5 2017 9.3_old - [1] [A tale of a lesser known NFS privesc](https://www.errno.fr/nfs_privesc.html) {{#include ../../banners/hacktricks-training.md}} - - diff --git a/src/linux-hardening/interesting-files-permissions/selinux.md b/src/linux-hardening/interesting-files-permissions/selinux.md index 31e02e3da83..a1f611b0070 100644 --- a/src/linux-hardening/interesting-files-permissions/selinux.md +++ b/src/linux-hardening/interesting-files-permissions/selinux.md @@ -219,7 +219,7 @@ sudo -l 2>/dev/null grep -R "ROLE=\|TYPE=" /etc/sudoers /etc/sudoers.d 2>/dev/null ``` -On many mainstream systems, users are mapped to `unconfined_u`, which reduces the practical impact of user confinement. On hardened deployments, however, confined users can make `sudo`, `su`, `newrole`, and `runcon` much more interesting because **the escalation path may depend on entering a better SELinux role/type, not only on becoming UID 0**. Also remember that some confined users cannot invoke `sudo`/`su` at all unless policy explicitly allows the underlying setuid transition, so a host using `staff_u` + `sysadm_r` can turn a seemingly minor `sudo ROLE=` / `TYPE=` rule into the real privilege boundary. +On many mainstream systems, users are mapped to `unconfined_u`, which reduces the practical impact of user confinement. On hardened deployments, however, confined users can make `sudo`, `su`, `newrole`, and `runcon` much more interesting because **the escalation path may depend on entering a better SELinux role/type, not only on becoming UID 0**. Also remember that some confined users cannot invoke `sudo`/`su` at all unless policy explicitly allows the underlying setuid transition, so a host using `staff_u` + `sysadm_r` can turn a seemingly minor `sudo ROLE=` / `TYPE=` rule into the real privilege boundary.[[3]](#references) ## SELinux in Containers diff --git a/src/linux-hardening/interesting-files-permissions/suid-shared-library-and-linker-abuse.md b/src/linux-hardening/interesting-files-permissions/suid-shared-library-and-linker-abuse.md index 8d88bac1521..7ffb2cffe08 100644 --- a/src/linux-hardening/interesting-files-permissions/suid-shared-library-and-linker-abuse.md +++ b/src/linux-hardening/interesting-files-permissions/suid-shared-library-and-linker-abuse.md @@ -171,4 +171,5 @@ The abuse is not that a hardlink changes permissions. The abuse is path confusio - Do not preserve `LD_PRELOAD`, `LD_LIBRARY_PATH`, or similar loader variables through sudo. - Monitor `/etc/ld.so.preload`, `/etc/ld.so.conf`, `/etc/ld.so.conf.d/`, and unexpected SUID files. - Review hardlinked SUID files and investigate custom SUID wrappers outside standard system paths. + {{#include ../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/linux-basics/linux-environment-variables.md b/src/linux-hardening/linux-basics/linux-environment-variables.md index f5781ad89e1..c10c780e1eb 100644 --- a/src/linux-hardening/linux-basics/linux-environment-variables.md +++ b/src/linux-hardening/linux-basics/linux-environment-variables.md @@ -192,7 +192,7 @@ ldso=$(ls /lib64/ld-linux-*.so.* /lib/*-linux-gnu/ld-linux-*.so.* 2>/dev/null | ### **GLIBC_TUNABLES** -`GLIBC_TUNABLES` changes early glibc behavior (for example, allocator tunables) and is very handy in exploit labs. It also matters from a security perspective because the **dynamic loader parses it very early**. The 2023 **Looney Tunables** bug was a good reminder that a single environment variable parsed in the loader can become a **local privilege-escalation primitive** against SUID programs. +`GLIBC_TUNABLES` changes early glibc behavior (for example, allocator tunables) and is very handy in exploit labs. It also matters from a security perspective because the **dynamic loader parses it very early**. The 2023 **Looney Tunables** bug was a good reminder that a single environment variable parsed in the loader can become a **local privilege-escalation primitive** against SUID programs.[[6]](#references) ```bash GLIBC_TUNABLES=glibc.malloc.tcache_count=0 ./binary @@ -343,5 +343,6 @@ One background job, one stopped and last command didn't finish correctly: - [3] [Qualys - LPEs in needrestart](https://www.qualys.com/2024/11/19/needrestart/needrestart.txt) - [4] [Node.js CLI documentation - `NODE_OPTIONS`](https://nodejs.org/api/cli.html) - [5] [Common environment variables - Geek University](https://geek-university.com/linux/common-environment-variables/) +- [6] [CVE-2023-4911: Looney Tunables - Local Privilege Escalation in the glibc's ld.so - Qualys](https://blog.qualys.com/vulnerabilities-threat-research/2023/10/03/cve-2023-4911-looney-tunables-local-privilege-escalation-in-the-glibcs-ld-so) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/linux-basics/linux-privilege-escalation/README.md b/src/linux-hardening/linux-basics/linux-privilege-escalation/README.md index f2f8115bc30..e1ab9a95be4 100644 --- a/src/linux-hardening/linux-basics/linux-privilege-escalation/README.md +++ b/src/linux-hardening/linux-basics/linux-privilege-escalation/README.md @@ -94,7 +94,7 @@ sudo -V | grep "Sudo ver" | grep "1\.[01234567]\.[0-9]\+\|1\.8\.1[0-9]\*\|1\.8\. ### Sudo < 1.9.17p1 -Sudo versions before 1.9.17p1 (**1.9.14 - 1.9.17 < 1.9.17p1**) allows unprivileged local users to escalate their privileges to root via sudo `--chroot` option when `/etc/nsswitch.conf` file is used from a user controlled directory.[[28]](#references) +Sudo versions before 1.9.17p1 (**1.9.14 - 1.9.17 < 1.9.17p1**) allows unprivileged local users to escalate their privileges to root via sudo `--chroot` option when `/etc/nsswitch.conf` file is used from a user controlled directory.[[28]](#references)[[29]](#references) Here is a [PoC](https://github.com/pr0v3rbs/CVE-2025-32463_chwoot) to exploit that [vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2025-32463). Before running the exploit, make sure that your `sudo` version is vulnerable and that it supports the `chroot` feature. @@ -102,7 +102,7 @@ For more information, refer to the original [vulnerability advisory](https://www ### Sudo host-based rules bypass (CVE-2025-32462) -Sudo before 1.9.17p1 (reported affected range: **1.8.8–1.9.17**) can evaluate host-based sudoers rules using the **user-supplied hostname** from `sudo -h ` instead of the **real hostname**. If sudoers grants broader privileges on another host, you can **spoof** that host locally.[[28]](#references) +Sudo before 1.9.17p1 (reported affected range: **1.8.8–1.9.17**) can evaluate host-based sudoers rules using the **user-supplied hostname** from `sudo -h ` instead of the **real hostname**. If sudoers grants broader privileges on another host, you can **spoof** that host locally.[[29]](#references) Requirements: - Vulnerable sudo version @@ -496,8 +496,6 @@ Hardening - Avoid embedding secrets in unit files; use secret stores or root-only EnvironmentFile - Enable audit/logging for on-demand job executions - - Check if any scheduled job is vulnerable. Maybe you can take advantage of a script being executed by root (wildcard vuln? can modify files that root uses? use symlinks? create specific files in the directory that root uses?). ```bash @@ -1274,10 +1272,10 @@ sudo PYTHONPATH=/dev/shm/ /opt/scripts/admin_tasks.sh ### Writable `__pycache__` / `.pyc` poisoning in sudo-allowed Python imports -If a **sudo-allowed Python script** imports a module whose package directory contains a **writable `__pycache__`**, you may be able to replace the cached `.pyc` and get code execution as the privileged user on the next import.[[29]](#references) +If a **sudo-allowed Python script** imports a module whose package directory contains a **writable `__pycache__`**, you may be able to replace the cached `.pyc` and get code execution as the privileged user on the next import.[[30]](#references) - Why it works: - - CPython stores bytecode caches in `__pycache__/module.cpython-.pyc`.[[30]](#references) + - CPython stores bytecode caches in `__pycache__/module.cpython-.pyc`.[[31]](#references) - The interpreter validates the **header** (magic + timestamp/hash metadata tied to the source), then executes the marshaled code object stored after that header. - If you can **delete and recreate** the cached file because the directory is writable, a root-owned but non-writable `.pyc` can still be replaced. - Typical path: @@ -1293,7 +1291,7 @@ find / -type d -name __pycache__ -writable 2>/dev/null find / -type f -path '*/__pycache__/*.pyc' -ls 2>/dev/null ``` -If you can inspect the privileged script, identify imported modules and their cache path:[[31]](#references) +If you can inspect the privileged script, identify imported modules and their cache path:[[32]](#references) ```bash grep -R "^import \\|^from " /opt/target/ 2>/dev/null @@ -2346,9 +2344,10 @@ Learn more and see a generalized pattern applicable to other discovery/monitorin - [25] [0xdf – HTB Previous (sudo terraform dev_overrides + TF_VAR symlink privesc)](https://0xdf.gitlab.io/2026/01/10/htb-previous.html) - [26] [0xdf – HTB Slonik (pg_basebackup cron copy → SUID bash)](https://0xdf.gitlab.io/2026/02/12/htb-slonik.html) - [27] [NVISO – You name it, VMware elevates it (CVE-2025-41244)](https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/) -- [28] [0xdf – HTB: Expressway](https://0xdf.gitlab.io/2026/03/07/htb-expressway.html) -- [29] [0xdf – HTB: Browsed](https://0xdf.gitlab.io/2026/03/28/htb-browsed.html) -- [30] [PEP 3147 – PYC Repository Directories](https://peps.python.org/pep-3147/) -- [31] [Python importlib docs](https://docs.python.org/3/library/importlib.html) +- [28] [Stratascale – CVE-2025-32463: Sudo Chroot Elevation of Privilege](https://www.stratascale.com/resource/cve-2025-32463-sudo-chroot-elevation-of-privilege/) +- [29] [0xdf – HTB: Expressway](https://0xdf.gitlab.io/2026/03/07/htb-expressway.html) +- [30] [0xdf – HTB: Browsed](https://0xdf.gitlab.io/2026/03/28/htb-browsed.html) +- [31] [PEP 3147 – PYC Repository Directories](https://peps.python.org/pep-3147/) +- [32] [Python importlib docs](https://docs.python.org/3/library/importlib.html) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/linux-basics/useful-linux-commands.md b/src/linux-hardening/linux-basics/useful-linux-commands.md index 51a815afd71..e749cf0a81d 100644 --- a/src/linux-hardening/linux-basics/useful-linux-commands.md +++ b/src/linux-hardening/linux-basics/useful-linux-commands.md @@ -362,4 +362,3 @@ Add `--grep 'Invalid user' --case-sensitive` or `-k` (kernel ring buffer only) w - [2] [How to use the journalctl command to view Linux logs](https://www.hostinger.com/tutorials/journalctl-command) {{#include ../../banners/hacktricks-training.md}} - diff --git a/src/linux-hardening/main-system-information/escaping-from-limited-bash.md b/src/linux-hardening/main-system-information/escaping-from-limited-bash.md index e7b086ba410..f62e7a25bb4 100644 --- a/src/linux-hardening/main-system-information/escaping-from-limited-bash.md +++ b/src/linux-hardening/main-system-information/escaping-from-limited-bash.md @@ -179,7 +179,7 @@ type -a bash sh rbash ssh vi vim less more man awk find tar zip git scp script 2 ### Modify PATH -Check if you can modify the PATH env variable +Check if you can modify the PATH env variable[[2]](#references) ```bash echo $PATH #See the path of the executables that you can use @@ -351,9 +351,9 @@ debug.debug() ## References -- [https://www.youtube.com/watch?v=UO618TeyCWo](https://www.youtube.com/watch?v=UO618TeyCWo) (Slides: [https://deepsec.net/docs/Slides/2015/Chw00t_How_To_Break%20Out_from_Various_Chroot_Solutions\_-_Bucsay_Balazs.pdf](https://deepsec.net/docs/Slides/2015/Chw00t_How_To_Break%20Out_from_Various_Chroot_Solutions_-_Bucsay_Balazs.pdf)) -- [https://www.gnu.org/software/bash/manual/html_node/The-Restricted-Shell.html](https://www.gnu.org/software/bash/manual/html_node/The-Restricted-Shell.html) -- [https://git-scm.com/docs/git-shell](https://git-scm.com/docs/git-shell) +- [1] [Chw00t: How To Break Out from Various Chroot Solutions (Bucsay Balazs, DeepSec talk and slides)](https://www.youtube.com/watch?v=UO618TeyCWo) +- [2] [GNU Bash Reference Manual – The Restricted Shell](https://www.gnu.org/software/bash/manual/html_node/The-Restricted-Shell.html) +- [3] [git-shell – Git Documentation](https://git-scm.com/docs/git-shell) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/main-system-information/filesystem-inodes-and-recovery.md b/src/linux-hardening/main-system-information/filesystem-inodes-and-recovery.md index 3f3ba4fa721..d8327e6d15c 100644 --- a/src/linux-hardening/main-system-information/filesystem-inodes-and-recovery.md +++ b/src/linux-hardening/main-system-information/filesystem-inodes-and-recovery.md @@ -186,4 +186,5 @@ Treat ordering as a clue, not proof. Copy operations, archive extraction, filesy - Use `nosuid`, `nodev`, and `noexec` where operationally appropriate, but do not treat them as a complete boundary. - Restrict access to `/proc//fd`, process metadata, and cross-user process inspection where possible. - Monitor writable mount points, unexpected hardlinks to privileged files, and deleted-but-open sensitive files. + {{#include ../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/main-system-information/kernel-lpe-cves/copy-fail-af_alg-splice-page-cache-overwrite-cve-2026-31431.md b/src/linux-hardening/main-system-information/kernel-lpe-cves/copy-fail-af_alg-splice-page-cache-overwrite-cve-2026-31431.md index 3c4af0ff448..846d546d6b3 100644 --- a/src/linux-hardening/main-system-information/kernel-lpe-cves/copy-fail-af_alg-splice-page-cache-overwrite-cve-2026-31431.md +++ b/src/linux-hardening/main-system-information/kernel-lpe-cves/copy-fail-af_alg-splice-page-cache-overwrite-cve-2026-31431.md @@ -119,7 +119,7 @@ For containerized environments, `AF_ALG` should be treated as a **kernel attack ## References - [1] [Xint write-up: Copy Fail: 732 Bytes to Root on Every Major Linux Distributions](https://xint.io/blog/copy-fail-linux-distributions) -- [2] [Copy Fail advisory / mitigation page](https://copy.fail/) +- [2] [Copy Fail (CVE-2026-31431) advisory and mitigation page](https://copy.fail/) - [3] [Linux fix: `crypto: algif_aead - Revert to operating out-of-place` (`a664bf3d603d`)](https://github.com/torvalds/linux/commit/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5) - [4] [Linux commit: `crypto: algif_aead - copy AAD from src to dst` (`72548b093ee3`)](https://github.com/torvalds/linux/commit/72548b093ee3) - [5] [Linux commit: `crypto: authencesn - Convert to new AEAD interface` (`104880a6b470`)](https://github.com/torvalds/linux/commit/104880a6b470) diff --git a/src/linux-hardening/main-system-information/kernel-lpe-cves/linux-ptrace-exit-race-pidfd_getfd-fd-theft.md b/src/linux-hardening/main-system-information/kernel-lpe-cves/linux-ptrace-exit-race-pidfd_getfd-fd-theft.md index 165f8140e84..2ddec3eaa34 100644 --- a/src/linux-hardening/main-system-information/kernel-lpe-cves/linux-ptrace-exit-race-pidfd_getfd-fd-theft.md +++ b/src/linux-hardening/main-system-information/kernel-lpe-cves/linux-ptrace-exit-race-pidfd_getfd-fd-theft.md @@ -85,7 +85,7 @@ When auditing the kernel, treat any path that does **ptrace-equivalent authoriza ## References -- [1] [Qualys blog: CVE-2026-46333](https://blog.qualys.com/vulnerabilities-threat-research/2026/05/20/cve-2026-46333-local-root-privilege-escalation-and-credential-disclosure-in-the-linux-kernel-ptrace-path) +- [1] [CVE-2026-46333: Local Root Privilege Escalation and Credential Disclosure in the Linux Kernel ptrace Path (Qualys)](https://blog.qualys.com/vulnerabilities-threat-research/2026/05/20/cve-2026-46333-local-root-privilege-escalation-and-credential-disclosure-in-the-linux-kernel-ptrace-path) - [2] [Qualys advisory TXT](https://cdn2.qualys.com/advisory/2026/05/20/cve-2026-46333-ptrace.txt) - [3] [pidfd_getfd(2) manual page](https://man7.org/linux/man-pages/man2/pidfd_getfd.2.html) - [4] [Linux kernel Yama documentation](https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) diff --git a/src/linux-hardening/main-system-information/kernel-lpe-cves/posix-cpu-timers-toctou-cve-2025-38352.md b/src/linux-hardening/main-system-information/kernel-lpe-cves/posix-cpu-timers-toctou-cve-2025-38352.md index 64d06eea8cf..37e4198361d 100644 --- a/src/linux-hardening/main-system-information/kernel-lpe-cves/posix-cpu-timers-toctou-cve-2025-38352.md +++ b/src/linux-hardening/main-system-information/kernel-lpe-cves/posix-cpu-timers-toctou-cve-2025-38352.md @@ -200,7 +200,7 @@ Why TASK_WORK mode is safe by design - Even then, if the task is already exiting, task_work_add() fails; gating on exit_state makes both modes consistent. Fix (Android common kernel) and rationale -- Add an early return if current task is exiting, gating all processing:[[1]](#references)[[3]](#references) +- Add an early return if current task is exiting, gating all processing:[[1]](#references)[[3]](#references)[[6]](#references) ```c // kernel/time/posix-cpu-timers.c (Android common kernel commit 157f357d50b5038e5eaad0b2b438f923ac40afeb) @@ -208,7 +208,7 @@ if (tsk->exit_state) return; ``` -- This prevents entering handle_posix_cpu_timers() for exiting tasks, eliminating the window where posix_cpu_timer_del() could miss it.cpu.firing and race with expiry processing.[[1]](#references)[[3]](#references) +- This prevents entering handle_posix_cpu_timers() for exiting tasks, eliminating the window where posix_cpu_timer_del() could miss it.cpu.firing and race with expiry processing.[[1]](#references)[[3]](#references)[[6]](#references) Impact - Kernel memory corruption of timer structures during concurrent expiry/deletion can yield immediate crashes (DoS) and is a strong primitive toward privilege escalation due to arbitrary kernel-state manipulation opportunities. diff --git a/src/linux-hardening/main-system-information/kernel-lpe-cves/vmware-tools-service-discovery-untrusted-search-path-cve-2025-41244.md b/src/linux-hardening/main-system-information/kernel-lpe-cves/vmware-tools-service-discovery-untrusted-search-path-cve-2025-41244.md index d8d0e8440c0..0f2b48e5d92 100644 --- a/src/linux-hardening/main-system-information/kernel-lpe-cves/vmware-tools-service-discovery-untrusted-search-path-cve-2025-41244.md +++ b/src/linux-hardening/main-system-information/kernel-lpe-cves/vmware-tools-service-discovery-untrusted-search-path-cve-2025-41244.md @@ -145,7 +145,7 @@ esac ## References - [1] [NVISO – You name it, VMware elevates it (CVE-2025-41244)](https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/) -- [2] [Broadcom advisory for CVE-2025-41244](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149) +- [2] [VMSA-2025-0015.1 – VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244, CVE-2025-41245, CVE-2025-41246) (Broadcom)](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149) - [3] [open-vm-tools – serviceDiscovery/get-versions.sh (stable-13.0.0)](https://github.com/vmware/open-vm-tools/blob/stable-13.0.0/open-vm-tools/services/plugins/serviceDiscovery/get-versions.sh) - [4] [MITRE ATT&CK T1036.005 – Match Legitimate Name or Location](https://attack.mitre.org/techniques/T1036/005/) - [5] [CWE-426: Untrusted Search Path](https://cwe.mitre.org/data/definitions/426.html) diff --git a/src/linux-hardening/main-system-information/kernel-modules-and-modprobe.md b/src/linux-hardening/main-system-information/kernel-modules-and-modprobe.md index 30886d3f00d..7cf41f0c925 100644 --- a/src/linux-hardening/main-system-information/kernel-modules-and-modprobe.md +++ b/src/linux-hardening/main-system-information/kernel-modules-and-modprobe.md @@ -176,4 +176,5 @@ Defensive notes: - Set `kernel.modules_disabled=1` after boot where operationally possible. - Enforce module signing on systems that require loadable modules. - Monitor writes to `/proc/sys/kernel/modprobe`, `/lib/modules`, and unexpected `insmod`/`modprobe` execution. + {{#include ../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/main-system-information/linux-privilege-escalation-checklist.md b/src/linux-hardening/main-system-information/linux-privilege-escalation-checklist.md index deab08d307a..10bd8cc2d32 100644 --- a/src/linux-hardening/main-system-information/linux-privilege-escalation-checklist.md +++ b/src/linux-hardening/main-system-information/linux-privilege-escalation-checklist.md @@ -150,10 +150,8 @@ - [ ] Can you [**abuse NFS to escalate privileges**](../linux-basics/linux-privilege-escalation/index.html#nfs-privilege-escalation)? - [ ] Do you need to [**escape from a restrictive shell**](../linux-basics/linux-privilege-escalation/index.html#escaping-from-restricted-shells)? - - ## References -- [Sudo advisory: sudoedit arbitrary file edit](https://www.sudo.ws/security/advisories/sudoedit_any/) -- [Oracle Linux docs: systemd drop-in configuration](https://docs.oracle.com/en/operating-systems/oracle-linux/8/systemd/ModifyingsystemdConfigurationFiles.html) +- [1] [Sudo advisory: sudoedit arbitrary file edit](https://www.sudo.ws/security/advisories/sudoedit_any/) +- [2] [Oracle Linux docs: systemd drop-in configuration](https://docs.oracle.com/en/operating-systems/oracle-linux/8/systemd/ModifyingsystemdConfigurationFiles.html) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/main-system-information/sudo-command-abuse.md b/src/linux-hardening/main-system-information/sudo-command-abuse.md index 333a5d21651..7672e81f8ac 100644 --- a/src/linux-hardening/main-system-information/sudo-command-abuse.md +++ b/src/linux-hardening/main-system-information/sudo-command-abuse.md @@ -86,4 +86,5 @@ Pagers such as `less` can also expose shell execution: - If an interpreter is unavoidable, restrict the exact script path and prevent user-controlled arguments, writable imports, `PYTHONPATH`, and unsafe environment preservation. - If file editing is required, restrict the exact file path and consider `sudoedit` with patched sudo versions and strict environment handling. - Review `SETENV`, `env_keep`, writable working directories, writable module/import paths, `NOEXEC`, `use_pty`, and logging, but do not treat them as a complete sandbox. + {{#include ../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/network-information/cisco-vmanage.md b/src/linux-hardening/network-information/cisco-vmanage.md index b872463ecdb..18e6e05f8c9 100644 --- a/src/linux-hardening/network-information/cisco-vmanage.md +++ b/src/linux-hardening/network-information/cisco-vmanage.md @@ -73,7 +73,7 @@ uid=0(root) gid=0(root) groups=0(root) (Example from [https://medium.com/walmartglobaltech/hacking-cisco-sd-wan-vmanage-19-2-2-from-csrf-to-remote-code-execution-5f73e2913e77](https://medium.com/walmartglobaltech/hacking-cisco-sd-wan-vmanage-19-2-2-from-csrf-to-remote-code-execution-5f73e2913e77))[[6]](#references) -The blog¹ by the synacktiv team described an elegant way to get a root shell, but the caveat is it requires getting a copy of the `/usr/bin/confd_cli_user` which is only readable by root. I found another way to escalate to root without such hassle. +The blog[[5]](#references) by the synacktiv team described an elegant way to get a root shell, but the caveat is it requires getting a copy of the `/usr/bin/confd_cli_user` which is only readable by root. I found another way to escalate to root without such hassle. When I disassembled `/usr/bin/confd_cli` binary, I observed the following: @@ -267,7 +267,7 @@ This bug class chains especially well with remote footholds that grant `netadmin - **Authenticated UI XSS (CVE-2024-20475)** – Steal an admin session in the web UI, then pivot into API/CLI actions that eventually reach `vshell` or one of the local privesc paths above. - **Remote auth bypass to `netadmin` (CVE-2026-20129)** – Very strong precursor for Path 5 because `netadmin` is exactly the level required by the 2026 crafted-file privesc.[[3]](#references) - **Authenticated arbitrary file write (CVE-2026-20262)** – Similar offensive value to CVE-2026-20122 but through a later web UI upload path: write into a location that will later be parsed by root or by the management-plane web tier. -- **Downgrade to resurrect old CLI privesc (CVE-2022-20775)** – 2026 intrusions showed attackers can roll back to an older vulnerable SD-WAN build, abuse the old CLI root bug, and then restore the original version. +- **Downgrade to resurrect old CLI privesc (CVE-2022-20775)** – 2026 intrusions showed attackers can roll back to an older vulnerable SD-WAN build, abuse the old CLI root bug, and then restore the original version.[[8]](#references) - **Pre-auth control-plane auth bypass (CVE-2026-20182)** – Better documented in the dedicated SD-WAN control-plane page; it can append an SSH key for `vmanage-admin`, giving you the local foothold needed to revisit this page. @@ -281,5 +281,6 @@ This bug class chains especially well with remote footholds that grant `netadmin - [5] [Pentesting Cisco SD-WAN Part 1: Attacking vManage](https://www.synacktiv.com/en/publications/pentesting-cisco-sd-wan-part-1-attacking-vmanage.html) - [6] [Hacking Cisco SD-WAN vManage 19.2.2 — From CSRF to Remote Code Execution](https://medium.com/walmartglobaltech/hacking-cisco-sd-wan-vmanage-19-2-2-from-csrf-to-remote-code-execution-5f73e2913e77) - [7] [Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability (CVE-2025-20122)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-priviesc-WCk7bmmt) +- [8] [Active exploitation of Cisco Catalyst SD-WAN by UAT-8616 (Cisco Talos)](https://blog.talosintelligence.com/uat-8616-sd-wan/) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/network-information/local-network-and-socket-triage.md b/src/linux-hardening/network-information/local-network-and-socket-triage.md index a1f7360c2c4..d8d879b9092 100644 --- a/src/linux-hardening/network-information/local-network-and-socket-triage.md +++ b/src/linux-hardening/network-information/local-network-and-socket-triage.md @@ -231,4 +231,5 @@ sudo nft list ruleset 2>/dev/null | head -n 80 ``` Prioritize services that are local-only, run as a more privileged user, expose admin/debug functions, or trust loopback/container-network clients. + {{#include ../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/network-information/socket-command-injection.md b/src/linux-hardening/network-information/socket-command-injection.md index a070c078f5e..81756c08cb8 100644 --- a/src/linux-hardening/network-information/socket-command-injection.md +++ b/src/linux-hardening/network-information/socket-command-injection.md @@ -83,4 +83,3 @@ Notes: - [1] [LG WebOS TV Path Traversal, Authentication Bypass and Full Device Takeover (SSD Disclosure)](https://ssd-disclosure.com/lg-webos-tv-path-traversal-authentication-bypass-and-full-device-takeover/) {{#include ../../banners/hacktricks-training.md}} - diff --git a/src/linux-hardening/post-exploitation/linux-post-exploitation/README.md b/src/linux-hardening/post-exploitation/linux-post-exploitation/README.md index f445bda7c08..ce5273c727b 100644 --- a/src/linux-hardening/post-exploitation/linux-post-exploitation/README.md +++ b/src/linux-hardening/post-exploitation/linux-post-exploitation/README.md @@ -116,7 +116,7 @@ Notes ## Systemd-stored credentials in unit files (Environment=) -Services launched by systemd may bake credentials into unit files as `Environment=` entries. Enumerate and extract them:[[1]](#references) +Services launched by systemd may bake credentials into unit files as `Environment=` entries. Enumerate and extract them:[[1]](#references)[[2]](#references) ```bash # Unit files and drop-ins diff --git a/src/linux-hardening/processes-crontab-systemd-dbus/d-bus-enumeration-and-command-injection-privilege-escalation.md b/src/linux-hardening/processes-crontab-systemd-dbus/d-bus-enumeration-and-command-injection-privilege-escalation.md index 3755644f4d6..ea370b4e9a9 100644 --- a/src/linux-hardening/processes-crontab-systemd-dbus/d-bus-enumeration-and-command-injection-privilege-escalation.md +++ b/src/linux-hardening/processes-crontab-systemd-dbus/d-bus-enumeration-and-command-injection-privilege-escalation.md @@ -75,7 +75,7 @@ That quickly tells you which `Exec=` path will start for an activatable name and #### Connections -[From wikipedia:](https://en.wikipedia.org/wiki/D-Bus) When a process sets up a connection to a bus, the bus assigns to the connection a special bus name called _unique connection name_. Bus names of this type are immutable—it's guaranteed they won't change as long as the connection exists—and, more importantly, they can't be reused during the bus lifetime. This means that no other connection to that bus will ever have assigned such unique connection name, even if the same process closes down the connection to the bus and creates a new one. Unique connection names are easily recognizable because they start with the—otherwise forbidden—colon character. +[From wikipedia:](https://en.wikipedia.org/wiki/D-Bus) When a process sets up a connection to a bus, the bus assigns to the connection a special bus name called _unique connection name_. Bus names of this type are immutable—it's guaranteed they won't change as long as the connection exists—and, more importantly, they can't be reused during the bus lifetime. This means that no other connection to that bus will ever have assigned such unique connection name, even if the same process closes down the connection to the bus and creates a new one. Unique connection names are easily recognizable because they start with the—otherwise forbidden—colon character.[[4]](#references) ### Service Object Info @@ -532,7 +532,7 @@ Enumeration of a large D-Bus attack surface manually with `busctl`/`gdbus` quick ### dbusmap ("Nmap for D-Bus") * Author: @taviso – [https://github.com/taviso/dbusmap](https://github.com/taviso/dbusmap) -* Written in C; single static binary (<50 kB) that walks every object path, pulls the `Introspect` XML and maps it to the owning PID/UID. +* Written in C; single static binary (<50 kB) that walks every object path, pulls the `Introspect` XML and maps it to the owning PID/UID.[[5]](#references) * Useful flags: ```bash # List every service on the *system* bus and dump all callable methods @@ -545,7 +545,7 @@ Enumeration of a large D-Bus attack surface manually with `busctl`/`gdbus` quick ### uptux.py * Author: @initstring – [https://github.com/initstring/uptux](https://github.com/initstring/uptux) -* Python-only script that looks for *writable* paths in systemd units **and** overly-permissive D-Bus policy files (e.g. `send_destination="*"`). +* Python-only script that looks for *writable* paths in systemd units **and** overly-permissive D-Bus policy files (e.g. `send_destination="*"`).[[6]](#references) * Quick usage: ```bash python3 uptux.py -n # run all checks but don’t write a log file @@ -593,5 +593,8 @@ Use `dbusmap --enable-probes` or manual `busctl call` to confirm whether a metho - [1] [USBCreator D-Bus Privilege Escalation in Ubuntu Desktop](https://unit42.paloaltonetworks.com/usbcreator-d-bus-privilege-escalation-in-ubuntu-desktop/) - [2] [CVE-2024-45752: D-Bus service allows configuration by any unprivileged user](https://github.com/PixlOne/logiops/issues/473) - [3] [dde-api-proxy: Authentication Bypass in Deepin D-Bus Proxy Service (CVE-2025-23222)](https://security.opensuse.org/2025/01/24/dde-api-proxy-privilege-escalation.html) +- [4] [D-Bus - Wikipedia](https://en.wikipedia.org/wiki/D-Bus) +- [5] [taviso/dbusmap - "Nmap for D-Bus"](https://github.com/taviso/dbusmap) +- [6] [initstring/uptux](https://github.com/initstring/uptux) {{#include ../../banners/hacktricks-training.md}} From d73b31c2edd3a5e534f5e2c79a2b12ca4b3feaff Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Thu, 6 Aug 2026 12:10:19 +0200 Subject: [PATCH 2/6] Restore full basic-forensic-methodology README The audit pass on this branch dropped ~half the page (8 of 16 sections). Align with the ht-5 version, which preserves master's structure, so the two branches no longer clash on this shared file. Co-Authored-By: Claude Opus 5 (1M context) --- .../basic-forensic-methodology/README.md | 74 +++++++++++++++++++ 1 file changed, 74 insertions(+) diff --git a/src/generic-methodologies-and-resources/basic-forensic-methodology/README.md b/src/generic-methodologies-and-resources/basic-forensic-methodology/README.md index 7ba1b51d3fd..ddb3d8316aa 100644 --- a/src/generic-methodologies-and-resources/basic-forensic-methodology/README.md +++ b/src/generic-methodologies-and-resources/basic-forensic-methodology/README.md @@ -23,6 +23,33 @@ malware-analysis.md if you are given a **forensic image** of a device you can start **analyzing the partitions, file-system** used and **recovering** potentially **interesting files** (even deleted ones). Learn how in: +{{#ref}} +partitions-file-systems-carving/ +{{#endref}}# Basic Forensic Methodology + + + +## Creating and Mounting an Image + + +{{#ref}} +../../generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.md +{{#endref}} + +## Malware Analysis + +This **isn't necessary the first step to perform once you have the image**. But you can use this malware analysis techniques independently if you have a file, a file-system image, memory image, pcap... so it's good to **keep these actions in mind**: + + +{{#ref}} +malware-analysis.md +{{#endref}} + +## Inspecting an Image + +if you are given a **forensic image** of a device you can start **analyzing the partitions, file-system** used and **recovering** potentially **interesting files** (even deleted ones). Learn how in: + + {{#ref}} partitions-file-systems-carving/ {{#endref}} @@ -92,6 +119,53 @@ anti-forensic-techniques.md ## Threat Hunting +{{#ref}} +file-integrity-monitoring.md +{{#endref}} + +## Deep inspection of specific file-types and Software + +If you have very **suspicious** **file**, then **depending on the file-type and software** that created it several **tricks** may be useful.\ +Read the following page to learn some interesting tricks: + + +{{#ref}} +specific-software-file-type-tricks/ +{{#endref}} + +I want to do a special mention to the page: + + +{{#ref}} +specific-software-file-type-tricks/browser-artifacts.md +{{#endref}} + +## Memory Dump Inspection + + +{{#ref}} +memory-dump-analysis/ +{{#endref}} + +## Pcap Inspection + + +{{#ref}} +pcap-inspection/ +{{#endref}} + +## **Anti-Forensic Techniques** + +Keep in mind the possible use of anti-forensic techniques: + + +{{#ref}} +anti-forensic-techniques.md +{{#endref}} + +## Threat Hunting + + {{#ref}} file-integrity-monitoring.md {{#endref}} From d31600c50a13123e2478b41c64cde0a3552c49df Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Thu, 6 Aug 2026 13:07:20 +0200 Subject: [PATCH 3/6] References: cite already-listed sources on the lines that mention them (5 citations) --- .../interesting-files-permissions/linux-capabilities.md | 2 +- .../linux-basics/linux-privilege-escalation/README.md | 4 ++-- ...-enumeration-and-command-injection-privilege-escalation.md | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/linux-hardening/interesting-files-permissions/linux-capabilities.md b/src/linux-hardening/interesting-files-permissions/linux-capabilities.md index 1a33a0e8cb6..d432b585b03 100644 --- a/src/linux-hardening/interesting-files-permissions/linux-capabilities.md +++ b/src/linux-hardening/interesting-files-permissions/linux-capabilities.md @@ -1600,7 +1600,7 @@ f.write('New content for the file\n') [**CAP_SYS_CHROOT**](https://man7.org/linux/man-pages/man7/capabilities.7.html) enables the execution of the `chroot(2)` system call, which can potentially allow for the escape from `chroot(2)` environments through known vulnerabilities:[[11]](#references) -- [How to break out from various chroot solutions](https://deepsec.net/docs/Slides/2015/Chw00t_How_To_Break%20Out_from_Various_Chroot_Solutions_-_Bucsay_Balazs.pdf) +- [How to break out from various chroot solutions](https://deepsec.net/docs/Slides/2015/Chw00t_How_To_Break%20Out_from_Various_Chroot_Solutions_-_Bucsay_Balazs.pdf)[[11]](#references) - [chw00t: chroot escape tool](https://github.com/earthquake/chw00t/) ## CAP_SYS_BOOT diff --git a/src/linux-hardening/linux-basics/linux-privilege-escalation/README.md b/src/linux-hardening/linux-basics/linux-privilege-escalation/README.md index e1ab9a95be4..6fb638ef2d8 100644 --- a/src/linux-hardening/linux-basics/linux-privilege-escalation/README.md +++ b/src/linux-hardening/linux-basics/linux-privilege-escalation/README.md @@ -98,7 +98,7 @@ Sudo versions before 1.9.17p1 (**1.9.14 - 1.9.17 < 1.9.17p1**) allows unprivileg Here is a [PoC](https://github.com/pr0v3rbs/CVE-2025-32463_chwoot) to exploit that [vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2025-32463). Before running the exploit, make sure that your `sudo` version is vulnerable and that it supports the `chroot` feature. -For more information, refer to the original [vulnerability advisory](https://www.stratascale.com/resource/cve-2025-32463-sudo-chroot-elevation-of-privilege/) +For more information, refer to the original [vulnerability advisory](https://www.stratascale.com/resource/cve-2025-32463-sudo-chroot-elevation-of-privilege/)[[28]](#references) ### Sudo host-based rules bypass (CVE-2025-32462) @@ -2223,7 +2223,7 @@ This vulnerability is very similar to [**CVE-2016-1247**](https://www.cvedetails ### /etc/sysconfig/network-scripts/ (Centos/Redhat) -**Vulnerability reference:** [**https://vulmon.com/exploitdetails?qidtp=maillist_fulldisclosure\&qid=e026a0c5f83df4fd532442e1324ffa4f**](https://vulmon.com/exploitdetails?qidtp=maillist_fulldisclosure&qid=e026a0c5f83df4fd532442e1324ffa4f) +**Vulnerability reference:** [**https://vulmon.com/exploitdetails?qidtp=maillist_fulldisclosure\&qid=e026a0c5f83df4fd532442e1324ffa4f**](https://vulmon.com/exploitdetails?qidtp=maillist_fulldisclosure&qid=e026a0c5f83df4fd532442e1324ffa4f)[[20]](#references) If, for whatever reason, a user is able to **write** an `ifcf-` script to _/etc/sysconfig/network-scripts_ **or** it can **adjust** an existing one, then your **system is pwned**.[[20]](#references) diff --git a/src/linux-hardening/processes-crontab-systemd-dbus/d-bus-enumeration-and-command-injection-privilege-escalation.md b/src/linux-hardening/processes-crontab-systemd-dbus/d-bus-enumeration-and-command-injection-privilege-escalation.md index ea370b4e9a9..018e0695d63 100644 --- a/src/linux-hardening/processes-crontab-systemd-dbus/d-bus-enumeration-and-command-injection-privilege-escalation.md +++ b/src/linux-hardening/processes-crontab-systemd-dbus/d-bus-enumeration-and-command-injection-privilege-escalation.md @@ -531,7 +531,7 @@ finish: Enumeration of a large D-Bus attack surface manually with `busctl`/`gdbus` quickly becomes painful. Two small FOSS utilities released in the last few years can speed things up during red-team or CTF engagements: ### dbusmap ("Nmap for D-Bus") -* Author: @taviso – [https://github.com/taviso/dbusmap](https://github.com/taviso/dbusmap) +* Author: @taviso – [https://github.com/taviso/dbusmap](https://github.com/taviso/dbusmap)[[5]](#references) * Written in C; single static binary (<50 kB) that walks every object path, pulls the `Introspect` XML and maps it to the owning PID/UID.[[5]](#references) * Useful flags: ```bash @@ -544,7 +544,7 @@ Enumeration of a large D-Bus attack surface manually with `busctl`/`gdbus` quick * The tool marks unprotected well-known names with `!`, instantly revealing services you can *own* (take over) or method calls that are reachable from an unprivileged shell. ### uptux.py -* Author: @initstring – [https://github.com/initstring/uptux](https://github.com/initstring/uptux) +* Author: @initstring – [https://github.com/initstring/uptux](https://github.com/initstring/uptux)[[6]](#references) * Python-only script that looks for *writable* paths in systemd units **and** overly-permissive D-Bus policy files (e.g. `send_destination="*"`).[[6]](#references) * Quick usage: ```bash From 5da2978772f979c661f7d040d81fa5ace39c9d3d Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Thu, 6 Aug 2026 13:25:11 +0200 Subject: [PATCH 4/6] References: add entries for content sources cited only inline Sources the prose draws on (writeups, advisories, research posts) now have a numbered References entry and the line that uses them cites it. Tool, download and product links are left inline. --- .../python/bypass-python-sandboxes/README.md | 3 ++- .../escaping-from-gui-applications.md | 3 ++- .../linux-basics/linux-privilege-escalation/README.md | 11 ++++++++--- ...tion-and-command-injection-privilege-escalation.md | 3 ++- 4 files changed, 14 insertions(+), 6 deletions(-) diff --git a/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/README.md b/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/README.md index e6bfdafdb83..3db47994705 100644 --- a/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/README.md +++ b/src/generic-methodologies-and-resources/python/bypass-python-sandboxes/README.md @@ -75,7 +75,7 @@ class P(object): print(base64.b64encode(pickle.dumps(P(), protocol=0))) ``` -For more information about how pickle works check this: [https://checkoway.net/musings/pickle/](https://checkoway.net/musings/pickle/) +For more information about how pickle works check this: [https://checkoway.net/musings/pickle/](https://checkoway.net/musings/pickle/)[[16]](#references) ### Pip package @@ -1217,5 +1217,6 @@ will be bypassed - [13] [BuckeyeCTF 2024 Author Writeups](https://corgi.rip/posts/buckeye-writeups/) - [14] [GeeksforGeeks – Vulnerability in str.format() in Python](https://www.geeksforgeeks.org/vulnerability-in-str-format-in-python/) - [15] [ur4ndom – [GCTF 2022] Treebox](https://ur4ndom.dev/posts/2022-07-04-gctf-treebox/) +- [16] [checkoway.net - Musings - Pickle](https://checkoway.net/musings/pickle) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/hardware-physical-access/escaping-from-gui-applications.md b/src/hardware-physical-access/escaping-from-gui-applications.md index 9fd8a081aa9..ae04f4065a4 100644 --- a/src/hardware-physical-access/escaping-from-gui-applications.md +++ b/src/hardware-physical-access/escaping-from-gui-applications.md @@ -172,7 +172,7 @@ Type this URLs to obtain an Explorer view: ### Show File Extensions -Check this page for more information: [https://www.howtohaven.com/system/show-file-extensions-in-windows-explorer.shtml](https://www.howtohaven.com/system/show-file-extensions-in-windows-explorer.shtml) +Check this page for more information: [https://www.howtohaven.com/system/show-file-extensions-in-windows-explorer.shtml](https://www.howtohaven.com/system/show-file-extensions-in-windows-explorer.shtml)[[7]](#references) ## Browsers tricks @@ -297,5 +297,6 @@ These shortcuts are for the visual settings and sound settings, depending on the - [4] [iPad shortcuts guide](https://www.tomsguide.com/us/ipad-shortcuts,news-18205.html) - [5] [Best iPad Keyboard Shortcuts](https://thesweetsetup.com/best-ipad-keyboard-shortcuts/) - [6] [iPad Keyboard Shortcuts](http://www.iphonehacks.com/2018/03/ipad-keyboard-shortcuts.html) +- [7] [howtohaven.com - Show File Extensions In Windows Explorer](https://www.howtohaven.com/system/show-file-extensions-in-windows-explorer.shtml) {{#include ../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/linux-basics/linux-privilege-escalation/README.md b/src/linux-hardening/linux-basics/linux-privilege-escalation/README.md index 6fb638ef2d8..35067078399 100644 --- a/src/linux-hardening/linux-basics/linux-privilege-escalation/README.md +++ b/src/linux-hardening/linux-basics/linux-privilege-escalation/README.md @@ -1170,7 +1170,7 @@ gpg --list-keys 2>/dev/null ### Big UID -Some Linux versions were affected by a bug that allows users with **UID > INT_MAX** to escalate privileges. More info: [here](https://gitlab.freedesktop.org/polkit/polkit/issues/74), [here](https://github.com/mirchr/security-research/blob/master/vulnerabilities/CVE-2018-19788.sh) and [here](https://twitter.com/paragonsec/status/1071152249529884674).\ +Some Linux versions were affected by a bug that allows users with **UID > INT_MAX** to escalate privileges. More info: [here](https://gitlab.freedesktop.org/polkit/polkit/issues/74), [here](https://github.com/mirchr/security-research/blob/master/vulnerabilities/CVE-2018-19788.sh) and [here](https://twitter.com/paragonsec/status/1071152249529884674).[[33]](#references)[[34]](#references)[[35]](#references)\ **Exploit it** using: **`systemd-run -t /bin/bash`** ### Groups @@ -2169,7 +2169,7 @@ Read the code of [**linPEAS**](https://github.com/carlospolop/privilege-escalati ### Logs If you can read logs, you may be able to find **interesting/confidential information inside them**. The more strange the log is, the more interesting it will be (probably).\ -Also, some "**bad**" configured (backdoored?) **audit logs** may allow you to **record passwords** inside audit logs as explained in this post: [https://www.redsiege.com/blog/2019/05/logging-passwords-on-linux/](https://www.redsiege.com/blog/2019/05/logging-passwords-on-linux/). +Also, some "**bad**" configured (backdoored?) **audit logs** may allow you to **record passwords** inside audit logs as explained in this post: [https://www.redsiege.com/blog/2019/05/logging-passwords-on-linux/](https://www.redsiege.com/blog/2019/05/logging-passwords-on-linux/).[[36]](#references) ```bash aureport --tty | grep -E "su |sudo " | sed -E "s,su|sudo,${C}[1;31m&${C}[0m,g" @@ -2215,7 +2215,7 @@ A vulnerability in `logrotate` lets users with **write permissions** on a log fi > [!TIP] > This vulnerability affects `logrotate` version `3.18.0` and older -More detailed information about the vulnerability can be found on this page: [https://tech.feedyourhead.at/content/details-of-a-logrotate-race-condition](https://tech.feedyourhead.at/content/details-of-a-logrotate-race-condition). +More detailed information about the vulnerability can be found on this page: [https://tech.feedyourhead.at/content/details-of-a-logrotate-race-condition](https://tech.feedyourhead.at/content/details-of-a-logrotate-race-condition).[[37]](#references) You can exploit this vulnerability with [**logrotten**](https://github.com/whotwagner/logrotten). @@ -2349,5 +2349,10 @@ Learn more and see a generalized pattern applicable to other discovery/monitorin - [30] [0xdf – HTB: Browsed](https://0xdf.gitlab.io/2026/03/28/htb-browsed.html) - [31] [PEP 3147 – PYC Repository Directories](https://peps.python.org/pep-3147/) - [32] [Python importlib docs](https://docs.python.org/3/library/importlib.html) +- [33] [polkit/polkit issue #74](https://gitlab.freedesktop.org/polkit/polkit/issues/74) +- [34] [mirchr/security-research](https://github.com/mirchr/security-research/blob/master/vulnerabilities/CVE-2018-19788.sh) +- [35] [Tweet by @paragonsec](https://twitter.com/paragonsec/status/1071152249529884674) +- [36] [redsiege.com - Logging Passwords On Linux](https://www.redsiege.com/blog/2019/05/logging-passwords-on-linux) +- [37] [tech.feedyourhead.at - Details Of A Logrotate Race Condition](https://tech.feedyourhead.at/content/details-of-a-logrotate-race-condition) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/linux-hardening/processes-crontab-systemd-dbus/d-bus-enumeration-and-command-injection-privilege-escalation.md b/src/linux-hardening/processes-crontab-systemd-dbus/d-bus-enumeration-and-command-injection-privilege-escalation.md index 018e0695d63..edd4f6014fb 100644 --- a/src/linux-hardening/processes-crontab-systemd-dbus/d-bus-enumeration-and-command-injection-privilege-escalation.md +++ b/src/linux-hardening/processes-crontab-systemd-dbus/d-bus-enumeration-and-command-injection-privilege-escalation.md @@ -282,7 +282,7 @@ dbus-monitor "type=error" "sender=org.freedesktop.SystemToolsBackends" dbus-monitor "type=method_call" "type=method_return" "type=error" ``` -See the [D-Bus documentation](http://dbus.freedesktop.org/doc/dbus-specification.html) for more information on match rule syntax. +See the [D-Bus documentation](http://dbus.freedesktop.org/doc/dbus-specification.html) for more information on match rule syntax.[[7]](#references) ### More @@ -596,5 +596,6 @@ Use `dbusmap --enable-probes` or manual `busctl call` to confirm whether a metho - [4] [D-Bus - Wikipedia](https://en.wikipedia.org/wiki/D-Bus) - [5] [taviso/dbusmap - "Nmap for D-Bus"](https://github.com/taviso/dbusmap) - [6] [initstring/uptux](https://github.com/initstring/uptux) +- [7] [dbus.freedesktop.org - D-Bus documentation](http://dbus.freedesktop.org/doc/dbus-specification.html) {{#include ../../banners/hacktricks-training.md}} From 06aaf562d11623030523d39224262902c794480c Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Thu, 6 Aug 2026 13:50:42 +0200 Subject: [PATCH 5/6] References: cite previously-unused reference entries Each superscript points at the existing line the reference documents. --- .../keras-model-deserialization-rce-and-gadget-hunting.md | 4 ++-- .../linux-basics/linux-privilege-escalation/README.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/generic-methodologies-and-resources/python/keras-model-deserialization-rce-and-gadget-hunting.md b/src/generic-methodologies-and-resources/python/keras-model-deserialization-rce-and-gadget-hunting.md index 2f4fb551047..138f90a7ecf 100644 --- a/src/generic-methodologies-and-resources/python/keras-model-deserialization-rce-and-gadget-hunting.md +++ b/src/generic-methodologies-and-resources/python/keras-model-deserialization-rce-and-gadget-hunting.md @@ -151,9 +151,9 @@ Important limitation: ## ML pickle import allowlisting for AI/ML models (Fickling) -Many AI/ML model formats (PyTorch .pt/.pth/.ckpt, joblib/scikit-learn, older TensorFlow artifacts, etc.) embed Python pickle data. Attackers routinely abuse pickle GLOBAL imports and object constructors to achieve RCE or model swapping during load. Blacklist-based scanners often miss novel or unlisted dangerous imports.[[8]](#references) +Many AI/ML model formats (PyTorch .pt/.pth/.ckpt, joblib/scikit-learn, older TensorFlow artifacts, etc.) embed Python pickle data. Attackers routinely abuse pickle GLOBAL imports and object constructors to achieve RCE or model swapping during load. Blacklist-based scanners often miss novel or unlisted dangerous imports.[[8]](#references)[[14]](#references) -A practical fail-closed defense is to hook Python’s pickle deserializer and only allow a reviewed set of harmless ML-related imports during unpickling. Trail of Bits’ Fickling implements this policy and ships a curated ML import allowlist built from thousands of public Hugging Face pickles.[[8]](#references) +A practical fail-closed defense is to hook Python’s pickle deserializer and only allow a reviewed set of harmless ML-related imports during unpickling. Trail of Bits’ Fickling implements this policy and ships a curated ML import allowlist built from thousands of public Hugging Face pickles.[[8]](#references)[[13]](#references) Security model for “safe” imports (intuitions distilled from research and practice): imported symbols used by a pickle must simultaneously:[[8]](#references) - Not execute code or cause execution (no compiled/source code objects, shelling out, hooks, etc.) diff --git a/src/linux-hardening/linux-basics/linux-privilege-escalation/README.md b/src/linux-hardening/linux-basics/linux-privilege-escalation/README.md index 35067078399..1e2460e6efd 100644 --- a/src/linux-hardening/linux-basics/linux-privilege-escalation/README.md +++ b/src/linux-hardening/linux-basics/linux-privilege-escalation/README.md @@ -1583,7 +1583,7 @@ sudo LD_LIBRARY_PATH=/tmp ### SUID Binary – .so injection -When encountering a binary with **SUID** permissions that seems unusual, it's a good practice to verify if it's loading **.so** files properly. This can be checked by running the following command: +When encountering a binary with **SUID** permissions that seems unusual, it's a good practice to verify if it's loading **.so** files properly. This can be checked by running the following command:[[17]](#references) ```bash strace 2>&1 | grep -i -E "open|access|no such file" From 041458df0cd1396e19791de4867fdadd06b7c7f8 Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Thu, 6 Aug 2026 14:01:42 +0200 Subject: [PATCH 6/6] basic-forensic-methodology: remove duplicated page content The page contained three overlapping copies of its section list (one of them glued onto a {{#endref}}). Keep the single complete copy; no content is lost. --- .../basic-forensic-methodology/README.md | 74 ------------------- 1 file changed, 74 deletions(-) diff --git a/src/generic-methodologies-and-resources/basic-forensic-methodology/README.md b/src/generic-methodologies-and-resources/basic-forensic-methodology/README.md index ddb3d8316aa..7ba1b51d3fd 100644 --- a/src/generic-methodologies-and-resources/basic-forensic-methodology/README.md +++ b/src/generic-methodologies-and-resources/basic-forensic-methodology/README.md @@ -23,33 +23,6 @@ malware-analysis.md if you are given a **forensic image** of a device you can start **analyzing the partitions, file-system** used and **recovering** potentially **interesting files** (even deleted ones). Learn how in: -{{#ref}} -partitions-file-systems-carving/ -{{#endref}}# Basic Forensic Methodology - - - -## Creating and Mounting an Image - - -{{#ref}} -../../generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.md -{{#endref}} - -## Malware Analysis - -This **isn't necessary the first step to perform once you have the image**. But you can use this malware analysis techniques independently if you have a file, a file-system image, memory image, pcap... so it's good to **keep these actions in mind**: - - -{{#ref}} -malware-analysis.md -{{#endref}} - -## Inspecting an Image - -if you are given a **forensic image** of a device you can start **analyzing the partitions, file-system** used and **recovering** potentially **interesting files** (even deleted ones). Learn how in: - - {{#ref}} partitions-file-systems-carving/ {{#endref}} @@ -119,53 +92,6 @@ anti-forensic-techniques.md ## Threat Hunting -{{#ref}} -file-integrity-monitoring.md -{{#endref}} - -## Deep inspection of specific file-types and Software - -If you have very **suspicious** **file**, then **depending on the file-type and software** that created it several **tricks** may be useful.\ -Read the following page to learn some interesting tricks: - - -{{#ref}} -specific-software-file-type-tricks/ -{{#endref}} - -I want to do a special mention to the page: - - -{{#ref}} -specific-software-file-type-tricks/browser-artifacts.md -{{#endref}} - -## Memory Dump Inspection - - -{{#ref}} -memory-dump-analysis/ -{{#endref}} - -## Pcap Inspection - - -{{#ref}} -pcap-inspection/ -{{#endref}} - -## **Anti-Forensic Techniques** - -Keep in mind the possible use of anti-forensic techniques: - - -{{#ref}} -anti-forensic-techniques.md -{{#endref}} - -## Threat Hunting - - {{#ref}} file-integrity-monitoring.md {{#endref}}