0

There is a server to which I have access (login and password). Logging in as this user on this server it is found that my user is not logged into sudoers. No additional information is available, I only have one this user.

I need to read /tmp/somefolder/file on this server.

/tmp/somefolder has permissions drwxr-xr-x, and /tmp/somefolder/file has permissions -rw-r-----.

I'm somewhere on the system, it's not clear which directory.

I do not own /tmp/somefolder and am not in the group that owns it, similarly I do not own /tmp/somefolder/file and am not in the group that owns it. How can I view the contents of /tmp/somefolder/file?

Improve this question
7
  • /tmp/somefolder has world-read and world-execute bits. That means anyone (including you) can see what the directory contains. However, /tmp/somefolder/file does not have world-read permissions, so if you're not the owning user or in that group, you cannot read the contents. That's by design. You'll have to ask the owner to let you read it. Commented Nov 12, 2024 at 9:31
  • On most systems, the umask is set so files have world-read access by default. If the world-read bit isn't set, then the owner could have deliberately changed the permissions to prevent anyone from reading it. Commented Nov 12, 2024 at 9:34
  • @Stewart, I don't have the ability to ask the owner for permission. Commented Nov 12, 2024 at 9:35
  • Hard to recommend something then. If someone wants something to be private, then it's going to be private. If you have physical access to the disk, and can plug it into another machine where you have root access, you could do something. Commented Nov 12, 2024 at 9:36
  • 3
    What you're going to learn from the situation as described is that if you don't have root privileges and don't have read access to a file via any of the access control lists, you don't get to see the contents of the file. If you want to read the contents of the file, either escalate your privileges or ask the file's owner or an administrator to loosen the access restrictions (or to add you to the group that is allowed to read that file) Commented Nov 12, 2024 at 9:56

2 Answers 2

Reset to default
1

/tmp/somefolder has permissions drwxr-xr-x [...] I do not own /tmp/somefolder and am not in the group that owns it

In this case, because you are neither owner nor part of the group your access rights are determined by the final set of permissions (d......r-x). These permit you to access the directory.

/tmp/somefolder/file has permissions -rw-r----- [...] I do not own /tmp/somefolder/file and am not in the group that owns it

The same rules apply: because you are neither owner nor part of the group your access rights are determined by the final set of permissions (-......---). In this case they grant you no access to the file. You cannot read it, copy it, execute it, or in any way do anything with the file.

As a bonus, had the parent directory (/tmp/somefolder) granted you write permission you could have deleted the file, or moved/renamed it within the same filesystem. But you still wouldn't be able to read it.

As another bonus, there might have been an Access Control List (ACL) on either the directory or the file, and these might grant you permissions not shown in the standard user-group-other permissions mask.

Improve this answer
0

Please note: the following examples are for Privilege Escalation. It is strictly forbidden to access information systems or data that have not been previously authorized. This post is for educational purposes only.

You can try consulting the /etc/passwd file for local users and /etc/group to find out which users have which rights. And Application users maybe.

Example 1 : If you have "docker" group on your user, you can do an elevation rights with this command :

docker run -it --rm -v /:/host debian:latest /bin/bash
  • "-v /:/host" : permit to map root directory (/) to /host directory inside container
  • "/bin/bash" : launch a bash terminal with default docker user "root" in the container

Then you can view your file in /host/tmp/somefolder/file

Source : https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation

Example 2 : you can check command with NOPASSWD (no password prompt) in sudoers folders :

  • /etc/sudoers
  • /etc/sudoers.d/*

With something like this in sudoers file :

%randomgroup ALL=(root) NOPASSWD:/usr/bin/sudo /usr/bin/chmod

You can execute chmod like you want. Or other example :

%randomgroup ALL=(root) NOPASSWD:/usr/bin/sudo /usr/bin/apt-get

You can open a terminal through this command : sudo apt-get update -o APT::Update::Pre-Invoke::= /bin/bash

Source : https://www.hackingarticles.in/linux-for-pentester-apt-privilege-escalation/

Improve this answer
1
  • It's clear from the question that the user doesn't have any elevation rights through sudo Commented Nov 12, 2024 at 20:24

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.