Welcome to part three of this module.
Today we're going to be taking a look at Unix privacy checker which is short for a Unix privilege escalation
checker.
This is a small and simple tool so I'm going to launch it right away so I can run it when I speak about
it the checker can be launched from either the terminal window or simply going to applications vulnerability
analysis and then clicking on the icon which looks like a little monkey
once it comes up.
We'll get this page essentially asking us if we want to run in standard mode or detailed mode detailed
mode is extremely slow.
So I'll be showing off in standard mode for time considerations so to launch the tool we're just going
to type Unix dash print cask dash check and then we're going to specify standard.
We could put in detailed as I said but standard for this demonstration
OK now that the audit is up and running all try to explain what this tool is.
Unix privacy checker is a script that runs on Unix systems.
It's been tested on Solaris 9 HP Unix eleven various flavors of Linux free BSD.
Six point two et cetera.
It tries to find mis configurations that could allow local unprivileged users to escalate privileges
to other users or access local applications such as databases.
It is written as a single shell script so it can be easily uploaded and run as opposed to being on tard
compiled and installed.
It can run either as a normal user or as a root user though obviously it does a better job when running
as root because it can read more files the tool comes prepackaged with Kelly 2.0 and can also be downloaded
from pen test monkey dot net
so at this point you might be wondering what is the point of this tool and Carly it's intended to be
run by security auditors and penetration testers against systems they have been engaged to assess and
also by system administrators who want to check for obvious mis configurations.
It can even be run as a cron job so you can check regularly for mis configurations that might be introduced.
There are a lot of possibilities for escalation that are just too hard to audit.
Using a script this script is intended to be a shortcut not a replacement for a proper auditing procedure.
Of course that's just the official description.
The real point of this script is that it is very lightweight.
You don't have to compile it or even upload it in a compressed form.
Imagine for a moment that you have remote access to a system but that access is limited.
You want to escalate your perspire privileges so you upload and run this simple little script.
It won't find every possibility that a trained penetration tester might through a long careful examination
of the system but it might come back with something that you can quickly use.
Time is a consideration during any pen test as many tools and scans require a certain number of minutes
or even hours to run properly.
And if you're working for a demanding employer you may be on a timetable.
The script is also popular with black hats who are less skilled and just want to find the easiest ways
into a system without much fuss.
What this tool lacks in artistry it makes up for inconvenience
really the main thing this tool is looking at are weak file permissions.
Note that whenever it checks file permissions It also checks the permissions on the parent directories
when it finds a group readable file or directory it flags an issue if that group has more than one non
root member.
So what are some examples of things it can find that you actually want to find.
Well let's say the home directory is rateable if you can write to someone's home directory.
You can add a dot R hosts file or a dot SS H authorization key file and thereby log in right away or
alter one of the log in scripts such as the bash profiles and have them create a super user I.D. shell
whenever they log in.
There are lots of problems with home directories that are right of all the script flags a warning if
any home directories are writeup all by anyone other than the owner or root user.
Another example is readable shadow at C directories although it is not so common these days.
This could allow you to read password hashes cracked them then log in as other users.
This script the script checks if the shadow file is readable by non users
it'll look for weak permissions on cron jobs as well chrome jobs are normally listed in the at C cron
tab and var spool cron cron tab directories cron jobs can be run by any user.
This script checks of cron jobs run programs that can be modified by users other than route and the
user.
The job runs as it also looks at rival configuration files programs that are run his route are listed
in lots of files.
If any of these files are rateable by non route users this script will flag a warning by the same token
the tool checks for rentable device files.
In other words it checks device files corresponding to currently mounted file systems and make sure
that they aren't readable.
It doesn't happen very often but it never hurts to check another thing the tool checks for readable
files in home directories and there can be a lot of interesting things in home directories.
But this script checks for files that contain passwords such as Dot any T or C dot my and Dot CnF as
well as AC ls like dot R hosts and Dot SS age if readable and these can provide a way to access local
applications or other local accounts.
Finally it checks to see that running processes correspond to rateable programs.
The script does a PSA listing attempting to determine the full path of each program and run a check
if it can be modified by anyone other than the user.
It's running as root the script also performs a couple of other checks related to privilege escalation
but not related to file permissions.
It checks pseudo configuration first.
Pseudo is one of the most obvious ways to escalate privileges if it is enabled sometimes only certain
commands can be run sometimes.
Any commands can be run if SC pseudo ers is readable.
The script checks if it's being used lists which users can use pseudo and which ones can use it without
a password.
Last but not least it checks for accounts with no passwords.
If Etsy shadow is readable the script lists any accounts without passwords that it finds.
I've never once seen this work but in theory you might get lucky.
So how useful is Unix.
Privacy checker in practice.
Well it depends largely on the base operating system and the amount of configuration an administrator
has done more configuration equals more chance of mistakes.
If you run it against a fairly modern operating system such as let's say Linux or Solaris 10 that hasn't
had much configuration done.
You're probably not going to find very much the operating systems have fairly secure file permissions
by default.
However if you run it against something like Solaris 8 or against a system that has been running for
a couple of years and has a lot of configuration done or it's running a lot of third party applications
that maybe aren't updated very frequently then you'll probably strike gold quite a bit.
That being said there are a lot of standard things that would normally be checked for during any real
audit that this tool simply doesn't look for.
Like I said it is meant to be a lightweight and simple method.
This is a quick and dirty way to check a target for simple ways to escalate privileges.
As such I really don't recommend this tool for professional pen Tester who is interested in during doing
a thorough job as a black hat tool though it has its uses particularly for those less skilled.
However it's really no replacement for a proper audit
so anyway as you can see the program is still running.
I'm going to make a quick cut to the end of this process for time consideration
and we'll look at the final results real quick when it's done so here we see that the tool has finished
running
and as we scroll up we can see all of the various things that it checked
and that's really about it.
It's very straightforward.
As I said
so I hope this video was of use to you and you understand the purpose of Unix privacy checker.
Like most of the tools in this module it really is just a straightforward run it type of program as
always.
Never run such a script against any system that you do not personally own or have written permission
to pen test.
If you find this tool useful and it is pretty nice I encourage you to check on line at pen test monkey
dot net for all the latest updates.
Thank you.