說明

與Windows相同，排程常常被駭客利用建立後門及提權，時常監控異動是非常重要的

作法

情境

主機有一個cronjob 每10分鐘監控安裝套件的清單

*/10 * * * * /opt/monitor/monitor_packages.sh

monitor_packages.sh

#!/bin/bash

# 定義檔案路徑
PACKAGE_LIST="installed_packages.txt"
TEMP_LIST="temp_packages.txt"
CHANGE_LOG="package_changes.log"

# 生成當前安裝清單
dpkg --get-selections > $TEMP_LIST

# 比較檔案
if ! diff $PACKAGE_LIST $TEMP_LIST > /dev/null; then
    echo "安裝清單有變動！" >> $CHANGE_LOG
    echo "變動內容：" >> $CHANGE_LOG
    diff $PACKAGE_LIST $TEMP_LIST >> $CHANGE_LOG
    echo "------" >> $CHANGE_LOG

    # 更新原始安裝清單
    mv $TEMP_LIST $PACKAGE_LIST
else
    rm $TEMP_LIST
fi

有權限問題的bash

不幸的，工程師將權限設定太大，所有人都可以修改

ls -al /opt/monitor/monitor_packages.sh 
-rwxrwxrwx 1 root root 537 Oct 10 18:04 /opt/monitor/monitor_packages.sh

攻擊者修改權限設定錯誤的script

1. 在monitor_packages.sh 加入一行指令，過一段時間排程啟動，紀錄一下相關日誌

else
    rm $TEMP_LIST
    chmod u+s /bin/dash

本機主機日誌 /var/log/auth.log

Oct 10 18:50:01 training-virtual-machine CRON[4663]: pam_unix(cron:session): session opened for user root by (uid=0)
Oct 10 18:50:01 training-virtual-machine CRON[4663]: pam_unix(cron:session): session closed for user root

本機主機日誌 /var/log/audit/audit.log
沒觀察到異常

type=USER_ACCT msg=audit(1728557401.186:414): pid=4663 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'

type=CRED_ACQ msg=audit(1728557401.186:415): pid=4663 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'

type=LOGIN msg=audit(1728557401.186:416): pid=4663 uid=0 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=12 res=1

type=SYSCALL msg=audit(1728557401.186:416): arch=c000003e syscall=1 success=yes exit=1 a0=6 a1=7ffe683ed180 a2=1 a3=a items=0 ppid=759 pid=4663 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=12 comm="cron" exe="/usr/sbin/cron" key=(null)

type=PROCTITLE msg=audit(1728557401.186:416): proctitle=2F7573722F7362696E2F43524F4E002D66

type=USER_START msg=audit(1728557401.186:417): pid=4663 uid=0 auid=0 ses=12 msg='op=PAM:session_open acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'

type=CRED_DISP msg=audit(1728557401.214:418): pid=4663 uid=0 auid=0 ses=12 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'

type=USER_END msg=audit(1728557401.214:419): pid=4663 uid=0 auid=0 ses=12 msg='op=PAM:session_close acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'

攻擊者提權取得root權限

下指令並驗證取得高權

$ /bin/dash -p
# whoami
root
# cat /etc/shadow
root:$6$pWlbCAmm$TT0Ogfv6YGE....

/bin/dash 不再預設監控內，沒有紀錄提權後的惡意操作
/var/log/auth.log
/var/log/audit/audit.log

強化監控

使用這個auditd rule
監控-w /bin/dash -p x -k susp_shell
https://github.com/Neo23x0/auditd

監控到dash異常操作

type=USER_START msg=audit(1728562801.811:1082): pid=5663 uid=0 auid=0 ses=25 msg='op=PAM:session_open acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
type=SYSCALL msg=audit(1728562801.811:1083): arch=c000003e syscall=59 success=yes exit=0 a0=5567dac53246 a1=7ffe683ed220 a2=5567dac53260 a3=7ffe683ed2c0 items=2 ppid=5663 pid=5664 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=25 comm="sh" exe="/bin/dash" key="susp_shell"
type=EXECVE msg=audit(1728562801.811:1083): argc=3 a0="/bin/sh" a1="-c" a2="/opt/monitor/monitor_packages.sh"

REF

Linux Privilege Escalation by Exploiting Cronjobs
https://www.hackingarticles.in/linux-privilege-escalation-by-exploiting-cron-jobs/

谈一谈Linux与suid提权
https://www.leavesongs.com/PENETRATION/linux-suid-privilege-escalation.html