Skip to content

Privesc.Playground.md

Latest commit

 

History

History
41 lines (30 loc) · 6.57 KB

Privesc.Playground.md

File metadata and controls

41 lines (30 loc) · 6.57 KB

Privesc Playground

Overview

Build an intentionally vulnerable Linux environment in Python with 20+ privilege escalation paths that students can discover and exploit in a safe, isolated setting. This project covers the most common real-world privilege escalation vectors found during penetration tests: SUID binaries, sudo misconfigurations, cron job exploitation, writable PATH directories, Docker socket access, capability abuse, and more. You will learn how Linux permission models work at a deep level, why small misconfigurations compound into full system compromise, and how to detect these weaknesses with automated scanning tools like linPEAS and GTFOBins.

Step-by-Step Instructions

  1. Set up the base environment and container infrastructure Create a Docker-based lab environment using Python scripts to orchestrate container creation and configuration. Build a base Debian image with common utilities installed (vim, gcc, python3, netcat, curl, wget). Design a user hierarchy: root, a service account, a standard user, and a restricted user. The Python orchestration layer should accept a configuration file (YAML) listing which vulnerability modules to enable, allowing students to customize the difficulty. Build a reset mechanism that destroys and recreates the container to its initial state in under 10 seconds.

  2. Implement SUID and SGID binary vulnerabilities Create six SUID/SGID-based escalation paths: a custom SUID binary that calls system() with a user-controlled argument, a SUID copy of find (which can execute commands via -exec), a SUID Python interpreter, a SGID binary that writes to a group-writable sensitive file, a SUID binary vulnerable to shared library injection (writable LD_LIBRARY_PATH or RPATH), and a SUID binary that reads files without dropping privileges (allowing /etc/shadow access). For each, write the vulnerable C program, compile it, and set the SUID bit during container setup.

  3. Build sudo misconfiguration vulnerabilities Configure five sudo-based escalation paths in /etc/sudoers: sudo access to vim (which allows shell escape), sudo access to less with NOPASSWD (shell escape via !sh), sudo access to tar (command execution via --checkpoint-action), sudo access to a custom script that uses unsanitized environment variables, and a wildcard sudo rule (/opt/scripts/*.sh) that allows path traversal. Each misconfiguration mirrors real findings from production penetration tests. The Python setup script should modify /etc/sudoers programmatically using visudo validation.

  4. Implement cron job and scheduled task vulnerabilities Create four cron-based escalation paths: a root cron job that executes a world-writable script, a cron job that runs with wildcard expansion in a user-writable directory (tar wildcard injection), a cron job that sources a world-writable environment file, and a systemd timer that runs a script from a PATH directory writable by the standard user. Set up the cron jobs during container initialization and create a monitoring page that shows students when cron jobs last ran and what they produced, so they can verify their exploits worked.

  5. Build path and environment variable exploitation Create four environment-based escalation paths: a root-owned script that calls a binary by name without full path (allowing PATH hijacking), a service that loads a shared library from a user-writable directory, a Python script running as root that imports from a writable PYTHONPATH, and a Perl script vulnerable to @INC manipulation. Each vulnerability teaches the principle that privilege escalation often comes from controlling the environment in which privileged code executes, not from bugs in the privileged code itself.

  6. Implement container and capability-based escalation Create three container/capability escalation paths: expose the Docker socket (/var/run/docker.sock) to the standard user (allowing container escape to host), grant the CAP_DAC_READ_SEARCH capability to a binary (allowing reading any file regardless of permissions), and grant CAP_SETUID to a custom binary (allowing UID changes). Also create a scenario where the container runs with --privileged flag, allowing mount of the host filesystem. Each scenario should include a brief indicator in the environment that hints at the vulnerability without giving away the exploit.

  7. Build the automated scanning and hint system Create a Python-based scanning tool that students can run to enumerate potential escalation vectors — a simplified version of linPEAS. The scanner should check: SUID/SGID binaries and cross-reference against GTFOBins, sudo permissions, writable cron scripts, writable PATH directories, Docker socket access, Linux capabilities on binaries, and world-writable sensitive files. For each finding, provide a risk rating and a hint that points toward the exploitation technique without fully revealing it. Include a --solution flag that shows the complete exploit for each vector.

  8. Create a progress tracking system and lab guides Build a progress tracker where each escalation path has a flag (a unique string stored in a file only readable by root or in a specific location). When a student achieves escalation, they submit the flag via a lightweight web API running in the container. Track which flags have been captured and display progress. Write guided lab documentation for each vulnerability category with: the concept explanation, how to discover the vulnerability, exploitation steps, the underlying Linux mechanism being abused, and the fix (what the administrator should have done differently). Package everything with a single docker compose up command.

Key Concepts to Learn

  • Linux file permission model: SUID, SGID, sticky bit, and capabilities
  • Sudo configuration syntax and common misconfiguration patterns
  • Cron job security and the risks of wildcard expansion
  • PATH hijacking and environment variable manipulation
  • Container security: Docker socket exposure and privileged mode risks
  • GTFOBins and living-off-the-land binary exploitation
  • Privilege escalation enumeration methodology
  • Defense hardening: how to prevent each escalation vector

Deliverables

  • Docker-based vulnerable Linux environment with 20+ escalation paths
  • Python orchestration layer with YAML-based vulnerability selection
  • Six SUID/SGID vulnerabilities with compiled C binaries
  • Five sudo misconfiguration scenarios
  • Four cron job and four environment variable exploitation paths
  • Container escape and capability abuse scenarios
  • Automated scanning tool with GTFOBins cross-reference
  • Flag-based progress tracking system with guided lab documentation