Service and Software Exploitation

Service and Software Exploitation

Vulnerable services running as root provide direct escalation paths through public exploits. Enumerate all running services with version information. Search for public exploits matching identified versions, prioritizing authenticated exploits accessible with current privileges. Local privilege escalation vulnerabilities in services like MySQL, PostgreSQL, or various web servers occasionally provide easy wins.

Configuration review of privileged services reveals credential exposure or command execution opportunities. Database configurations might contain plaintext passwords reused for system accounts. Web server configurations could expose sensitive file paths or enable PHP/CGI execution in writable directories. Service-specific knowledge guides targeted configuration reviews.

Shared library hijacking affects programs with misconfigured library loading. If privileged programs load libraries from writable directories or honor LD_LIBRARY_PATH, malicious libraries achieve code execution. Identify library loading patterns using ldd or strace, then craft libraries with constructor functions for privilege escalation.

Race condition exploitation requires specific vulnerable software but provides reliable escalation when available. Time-of-check to time-of-use vulnerabilities in SUID programs, symlink races in temporary file creation, or PID prediction attacks succeed against vulnerable implementations. While less common than configuration issues, understanding race conditions enables exploiting custom software.