Pentest
Privilege Escalation

Privilege Escalation

  • sudo

    First thing to check. See what the current user is allowed to do.

    sudo -l # List available commands

  • PEAS - GitHub

    Find common misconfigurations and vulnerabilities in Linux and Windows.

    Send linpeas via ssh

    scp linpeas.sh user@domain:/tmp

  • setuid Files

    Files with the setuid bit set are executed with the permissions of the owner of the file, not the user who started the program. This can be used to escalate privileges.

    GTFOBins has a list of setuid binaries that can be used to escalate privileges.

    Custom setuid files can be exploited using binary exploitation.

    Find files with the setuid bit set.

    find / -perm -u=s -type f 2>/dev/null

  • CVE-2021-3156 - Website

    sudo versions before 1.9.5p2 are vulnerable to a heap-based buffer overflow. This can be exploited to gain root access. Very useful on older systems.

    Some payload can be found in the Tools section.