Escalate and Defend: Linux Kernel Exploit Walkthrough
1 min read
Summary
In this article, the writer guides the reader through the Linux Kernel Exploits room on TryHackMe
The room teaches users to escalate privileges on a Linux system, and the author adds detail with screenshots of each step
The machine is running Ubuntu 14.04 LTS with a vulnerable kernel version, which the user discovers is affected by CVE-2015-1328 through enumeration
The author performed a Google search using the kernel version and discovered the overlayfs vulnerability, which can allow an attacker to escalate privileges
The user can then download the exploit from exploit-db.com, transfer it to the target, and execute it to gain root access on the system.
Following the walkthrough, the author then lists defensive strategies that users can take to prevent an attack like this one.
These strategies include regular patching, execution prevention, and mandatory access control, and alerting on suspicious behaviour with a layered detection strategy that uses SIEM and EDR.
The author concludes by saying that understanding the methodology and offensive side of this attack helps to improve a defence strategy and encourages users to follow these steps to stay secure.