Summary

  • In this article, the writer guides the reader through the Linux Kernel Exploits room on TryHackMe
  • The room teaches users to escalate privileges on a Linux system, and the author adds detail with screenshots of each step
  • The machine is running Ubuntu 14.04 LTS with a vulnerable kernel version, which the user discovers is affected by CVE-2015-1328 through enumeration
  • The author performed a Google search using the kernel version and discovered the overlayfs vulnerability, which can allow an attacker to escalate privileges
  • The user can then download the exploit from exploit-db.com, transfer it to the target, and execute it to gain root access on the system.
  • Following the walkthrough, the author then lists defensive strategies that users can take to prevent an attack like this one.
  • These strategies include regular patching, execution prevention, and mandatory access control, and alerting on suspicious behaviour with a layered detection strategy that uses SIEM and EDR.
  • The author concludes by saying that understanding the methodology and offensive side of this attack helps to improve a defence strategy and encourages users to follow these steps to stay secure.

By Nisha P

Original Article