CVE-2015-1328

TryHackMe Walkthrough – Linux Kernel Privilege Escalation (CVE-2015-1328)

Objective

The goal of this walkthrough was to escalate privileges from a low-privileged user (karen) to root by exploiting a vulnerable Linux kernel.

Step 1 – Initial Enumeration

After connecting to the target machine via SSH:

ssh karen@<target-ip>

I identified the Linux kernel version:

uname -r

Output:

3.13.0-24-generic

The machine was running Ubuntu 14.04 with the kernel 3.13.0-24-generic.

Step 2 – Search for Kernel Vulnerabilities

Since Linux privilege escalation often relies on vulnerable kernels, I searched Exploit-DB using SearchSploit:

searchsploit overlayfs ubuntu 3.13

Result:

Linux Kernel 3.13.0 < 3.19 (Ubuntu...) - overlayfs Local Privilege Escalation
37292.c

This exploit targets CVE-2015-1328, which affects Ubuntu kernels prior to the patched versions.

Step 3 – Understand the Vulnerability

Before executing any exploit, it is important to understand what it does.

The exploit abuses a flaw in OverlayFS, the Linux union filesystem.

The vulnerability exists because OverlayFS incorrectly handles file permissions when mounted inside a user namespace (CLONE_NEWUSER).

An unprivileged user can manipulate OverlayFS to create or modify files that should only be writable by root.

The exploit ultimately writes to:

/etc/ld.so.preload

This file tells the Linux dynamic loader to load a shared library before every dynamically linked executable.

By forcing the system to load a malicious shared library, the exploit gains code execution as root.

Step 4 – Obtain the Exploit

Using SearchSploit:

searchsploit -m 37292

This copied the exploit locally:

37292.c

The exploit was then transferred to the victim machine.

In this walkthrough, it was saved as:

/tmp/ofs.c

Step 5 – Compile the Exploit

Navigate to the directory containing the exploit:

cd /tmp

Compile it using GCC:

gcc ofs.c -o ofs

If the compilation succeeds, GCC produces no output.

Verify the executable exists:

ls -l

Expected:

-rwxr-xr-x ... ofs

Step 6 – Execute the Exploit

Run the executable:

./ofs

The exploit prints messages similar to:

spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library

Finally, it spawns a root shell:

#

Verify the privileges:

id

Output:

uid=0(root) gid=0(root)

Step 7 – Retrieve the Flag

With root privileges obtained:

cat /home/matt/flag1.txt

The file could now be read successfully.

How the Exploit Works

The exploit performs several actions internally.

1. Creates a User Namespace

unshare(CLONE_NEWUSER);

Linux user namespaces allow an unprivileged process to appear as root inside the namespace, without being root on the host.

This capability is essential for the attack.

2. Creates a Mount Namespace

clone(... CLONE_NEWNS ...)

A separate mount namespace isolates filesystem changes from the rest of the operating system.

This allows the exploit to mount OverlayFS without affecting the global filesystem.

3. Mounts OverlayFS

The exploit creates temporary directories:

/tmp/ns_sploit/
├── upper/
├── work/
└── o/

It then mounts OverlayFS:

Lower Layer
      │
      ▼
OverlayFS
      │
      ▼
Upper Layer

Due to the kernel vulnerability, OverlayFS incorrectly permits operations that should require root privileges.

4. Creates /etc/ld.so.preload

The exploit renames a writable file inside the OverlayFS mount to:

ld.so.preload

After remounting OverlayFS over /etc, this file becomes:

/etc/ld.so.preload

Normally, only root should be able to create this file.

5. Builds a Malicious Shared Library

The exploit writes a C source file:

/tmp/ofs-lib.c

Then compiles it:

gcc -fPIC -shared -o /tmp/ofs-lib.so /tmp/ofs-lib.c

The resulting shared library overrides the getuid() function.

6. Hijacks the Dynamic Linker

The exploit writes:

/tmp/ofs-lib.so

into:

/etc/ld.so.preload

Every dynamically linked executable now loads this malicious library before any system library.

7. Executes /bin/su

Finally:

execl("/bin/su", "su", NULL);

When su starts, the malicious getuid() function executes instead of the original.

The library:

• removes /etc/ld.so.preload
• deletes the malicious shared library
• calls:

setresuid(0,0,0);
setresgid(0,0,0);

• launches:

/bin/sh

The result is an interactive root shell.

Why This Works

The vulnerability is caused by incorrect permission handling in OverlayFS when used inside user namespaces.

An unprivileged user can manipulate OverlayFS to create privileged files such as:

/etc/ld.so.preload

Since the dynamic loader trusts this file, arbitrary code is executed as root.

Mitigation

This vulnerability was patched by Ubuntu in updated kernel releases.

Mitigation strategies include:

• Updating the Linux kernel to a patched version.
• Disabling unprivileged user namespaces when not required.
• Restricting OverlayFS usage.
• Applying security updates regularly.
• Monitoring for unauthorized modifications to:
  • /etc/ld.so.preload
  • /etc/ld.so.cache

Key Takeaways

• Always enumerate the kernel version during Linux privilege escalation.
• Verify whether the kernel version is vulnerable before attempting exploitation.
• Read and understand exploit code before executing it.
• Kernel exploits can lead directly to root privileges but may also crash the target system.
• In real-world penetration tests, kernel exploitation should only be attempted when explicitly authorized because of the potential impact on system stability.

Commands Used

# Enumerate kernel version
uname -r

# Search for exploit
searchsploit overlayfs ubuntu 3.13

# Copy exploit locally
searchsploit -m 37292

# Compile exploit
gcc ofs.c -o ofs

# Execute exploit
./ofs

# Verify privileges
id

# Read flag
cat /home/matt/flag1.txt