Questions tagged [privilege-escalation]

Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access throughout the environment

Filter by
Sorted by
Tagged with
0
votes
0answers
23 views

Trying to do privesc but struggling [duplicate]

I've ran LinEnum.py on the target machine and I get this I've tried running python and the server.py file as sudo but still get asked for a password, I've looked up online that it could be something ...
0
votes
0answers
49 views

How can I use nohup command to get root access of the target machine?

I am playing ctf and I have gained access to the target machine but not as root. I can see nohup utility has root access on the machine and I used this command to get the root access but that did not ...
1
vote
1answer
62 views

Host filesystem manipulation from docker vs. virtual machine

When reading about docker, I found a part of the documentation describing the attack surface of the docker daemon. From what I was able to understand, part of the argument is that it is possible to ...
0
votes
0answers
63 views

Taking over Windows DC as a domain user

What do you suggest in order to take over a Windows Domain Controller, given the fact that you gained access to a domain user workstation and so you have domain user credentials? I have domain user ...
0
votes
1answer
116 views

inject update-motd.d 00-header to run a script on ssh login

Is there a way to inject the 00-header to trigger a script that executes a shell upon ssh login. Im facing a scenario where the 00-header has root privileges and I can modify it. Im trying to have it ...
1
vote
0answers
77 views

linuxpam-pam unix-security-bypass

https://exchange.xforce.ibmcloud.com/vulnerabilities/31739 linuxpam-pamunix-security-bypass (31739) reported Jan 23, 2007 Linux-PAM could allow a remote attacker to bypass security restrictions, ...
1
vote
2answers
97 views

I am a member of the Administrators group on a Windows 7 box, how can I spawn a reverse shell with elevated privileges?

I am learning Windows Privilege escalation. I've managed to add a user to the Administrators group but I don't know how to execute nc.exe, present in the Temp dir, with elevated privileges. I am ...
102
votes
11answers
44k views

Is `sudo` almost useless?

Once an attacker has a shell as your sudoer user (or just compromised a local process enough), he/she can use one of the many privilege escalation tool to even automatically put themselves for example ...
0
votes
0answers
80 views

Metasploit: Issue with upgrading a low privilege shell (sessions -u)

Setup info: I don't believe this is the issue as I regularly update my system. I'll add one piece of information as an example. If you would really like to the rest then I can add more in later ...
1
vote
2answers
456 views

How do I know/find out about Minecraft Server Vulnerabilities?

I remember playing Minecraft (Java-we're only talking about Minecraft Java on the computer here) at like 13-14 years old, and having this server owner claim that the server has been hacked, and that ...
0
votes
1answer
93 views

What does the following lines of code mean? Can anyone explain step by step? [closed]

I'm still learning and this was a part of using systemctl for privilege escalation. eop=$(mktemp).service echo '[Service] ExecStart=/bin/sh -c "cat /root/root.txt > /tmp/output" [Install] ...
0
votes
2answers
286 views

Exectuting sudo command in one line within a non-tty shell

I have access to a server via RCE over http. I can send post requests to the server which results in command execution. I am attempting to escalate privileges via sudo (su is not installed). The ...
0
votes
1answer
86 views

Does sudo ever de-escalate privilege while the program/command/service is running?

For Example Is it safer to do: $ sudo [cmd] [args] [enter user password] or $ su - [enter root password] # [cmd] [args] I always assumed they are the exact same thing, because sudo utilizes ...
0
votes
0answers
46 views

Bypassing non-writeable permissions on Ubuntu server

Say I have gained RCE on a server which has a firewall blocking all egress traffic: Linux cmweb6 4.15.0-1040-azure #44-Ubuntu SMP Thu Feb 21 14:24:01 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux But I am ...
0
votes
0answers
435 views

Powershell (WinRM) and cmd.exe: reg query output deviation

during a CTF I encountered the following anomaly regarding PS & cmd.exe: I got access to a Windows x86 server through WinRM Port 5985 using evil-winrm. (https://github.com/Hackplayers/evil-winrm) ...
1
vote
1answer
146 views

Why not use sudo instead of setuid/setgid?

If it is an insecure practise to use setuid/setgid binaries, why do distributions, OSes force it? The big question: what prevents using sudo instead of the setuid/setgid binaries? "ping" would be ...
16
votes
1answer
8k views

How to do a privileges escalation with ping?

I am trying to achieve a privilege escalation. I have a virtual machine on Linux and I escaped from an rbash terminal. I have now a "normal" user terminal. My user is not in the sudoers file. Is it ...
-1
votes
1answer
304 views

Privilege escalation modifying cookie

I have two accounts, an administrator and a simple user. I can capture the administrator's cookie and use it in a simple user request, I find myself logged in with the administrator user and then log ...
12
votes
5answers
553 views

How can one tell if a binary is safe to give sudo permissions for to an untrusted user?

sudo is sometimes used to give untrusted or "semi-trusted" users the ability to perform certain tasks as root, while not giving them unlimited root access. This is usually done via an entry into /etc/...
0
votes
0answers
39 views

Unquoted Service Path with Windows Short Filename ( 8.3 filename convention)

So if there is a service which has executable path as below. Path to executable : C:\PROGRA~1\ABCSOFT~\service.exe Here the path is shortened using "8.3 filename" convention and the actual complete ...
1
vote
2answers
233 views

sudo whitelist just program perl

In visudo Ubuntu I whitelist this program myuser ALL=(root) NOPASSWD:/myuser/program.pl when I run sudo /myuser/program.pl I get prompt to set password. The solution is to add to visudo /usr/bin/...
7
votes
1answer
1k views

How to execute a command directly on the host system through docker.sock in a Docker container?

I've been studying Docker security and examining ways of escaping from container to host. Suppose Docker sock (docker.sock) is mounted into the container at /var/run/docker.sock, so that Docker ...
1
vote
3answers
209 views

Why doesn't nordvpn require sudo?

I've downloaded and installed nordvpn on Ubuntu and am a bit incredulous at its operation. After I downloaded its .deb file and installed it, apparently it can be activated with the command nordvpn ...
0
votes
1answer
62 views

Do world-writable systemd .service files created as symbolic links in /etc/systemd/system impose a security threat? [closed]

Do world-writable systemd .service files created as symbolic links in /etc/systemd/system impose a security threat? Would it be possible to somehow modify the links to target arbitrary .service files ...
2
votes
1answer
96 views

Is it ok to let someone unlock their own account with their admin account?

Scenario: Person A's normal computer account is personA. They have locked this out with too many bad password attempts. The user is part of the IT group, so they also have an admin account: personA-...
1
vote
1answer
58 views

Finding applications vulnerable to dll preloading on windows

An application is vulnerable to DLL preloading attack on Windows if it loads a DLL simply by it's name. Windows then goes on to search several folders and loads the first DLL with a matching name. ...
1
vote
1answer
1k views

Exploiting cron job running as root

There is a cron job running as root on a web server every 15 minutes: php cli-script.php (cli stands for "Command Line Interface", so is only accessible from command-line) It is not possible to ...
2
votes
2answers
517 views

Privilege Escalation TTY error while using sudo /usr/bin/vi command [closed]

I am currently trying to escalate my privileges on an Ubuntu box. When I enumerated the server and run "sudo -l" command, I found out /usr/bin/vi set to (root) NOPASSWD. (root) NOPASSWD: /usr/bin/vi /...
1
vote
1answer
3k views

Why doesn't my systemctl command work? [closed]

I'm working on a pentest VM, and have elevated my user privileges to that of a common user. I can see from my enumeration scans that systemctl has a SUID bit set, and has the ownership group listed as ...
2
votes
1answer
651 views

sudo restrictions circumvention with pkexec: root shell

I had corrupted my sudo setup. With no possibility to login as root (locked root account, broken sudo), a search made it clear: use pkexec. It worked. So far, so good. But that turns out to be a big ...
5
votes
1answer
130 views

How can a bad process obtain root by waiting for a user to run a command as sudo?

A comment on this answer states: The whole linux desktop provides very little protection against bad processes running as the user. A bad process could just watch the keyboard input and wait for ...
0
votes
0answers
50 views

What is possible with a non-administrative users Ticket Granting Ticket and/or NTLM hash?

During a penetration test, if a users NTLM hash or a valid Kerberos TGT is compromised, what attacks are possible if the user is not an administrator on any (in scope) workstations? For instance, it ...
0
votes
1answer
604 views

Django admin site privilege escalation

Last night, I read a PDF detailing a privilege escalation attack a researcher had performed on a Django admin site. I'm curious- was the unfortunate application susceptible to this attack due to a ...
0
votes
0answers
168 views

set-guid exploit of a program with relative path

I'm trying to exploit a program which has the set-guid bit enabled. The program is simple it contains the following (stage.c): #include <stdio.h> #include <stdlib.h> #include <unistd....
6
votes
2answers
409 views

Bash function manipulation explained

I was recently reading through a write up on a capture the flag Linux VulnHub machine. For privilege escalation, the author references 'bash function manipulation'. A Google search turns up very ...
1
vote
1answer
6k views

How can privilege escalation through pkexec be prevented?

I've managed to elevate privileges on a Linux machine (3.19) using pkexec, but I don't understand the mechanics. /usr/bin/pkexec has the SUID bit set (which is normal, I gather), and simply using it ...
0
votes
1answer
588 views

Why in LD_PRELOAD exploit we call unsetenv(LD_PRELOAD)?

Why to exploit LD_PRELOAD like is shown here https://touhidshaikh.com/blog/?p=827 in the .c file the first instruction is unsetenv(LD_PRELOAD)? Is it a routine action which all shared libraries do? Or ...
1
vote
1answer
159 views

Using SUID program to avoid having entries in sudoers

Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
1
vote
2answers
314 views

What is the difference between “missing function level access control” and “privilege escalation”?

I was going through a web application from my account and I was able to view some confidential information about my other account. I want to know if this is a case of missing function level access ...
1
vote
1answer
991 views

Get the privileges of root with the user with I do an exploit with Shellshock [closed]

I got the remote control of a linux machine with Shellshock attack in Kali Linux (attacker machine) to a TinyCore Linux (victim machine), I used this module to attack the CGI vulnerability: use ...
1
vote
2answers
137 views

Privilege Escalation On Shared Server [closed]

I recently did a ca /etc/passwd And it revealed many accounts and their respective directories. Is my shared server secure? Does this tell anything? Can a good hacker access my directory from ...
1
vote
1answer
560 views

Privilege escalation in Linux 2.6.32

I am in an audit and I need to show the client that privileges can be scaled but I have tried in various ways and I could not. The Kernel version is 2.6.32-754.3.5.el6.x86_64. I have already tried ...
1
vote
0answers
567 views

Command line tools exploitable on linux

I'm looking this interesting project https://gtfobins.github.io/ But I don't understand some assumption. For example, if you consider the mv command: https://gtfobins.github.io/gtfobins/mv/ They ...
2
votes
1answer
615 views

Is there a list of safe/normal/expected SUID files?

Exploitable SUID executables are a basic privilege escalation vector. But just doing a search for all such files turns up a bunch of results on any linux system, most or all of which are presumed to ...
64
votes
4answers
13k views

Are most Linux systems that allow non-root users to execute code straightforwardly rootable?

long story short if you can execute code on a box it is usually straightforward to get root (quote source) The immediate implication of this quote (if it's accurate) is that if you're running a ...
0
votes
2answers
2k views

Privilege Escalation: C functions setuid(0) with system() not working in Linux

Quick disclaimer: I fully understand that the code I am attempting to write is insecure, and allows for arbitrary users to escalate to root. I am writing a simple C program like this to demonstrate ...
1
vote
1answer
130 views

Harden against privilege escalation in Microservices

Please consider the following scenario. The system has a set of business owners (i.e. users of the system) Each business owner is mapped to a set of customers The business owners login to the system ...
5
votes
5answers
276 views

Unix Privilege Escalation: “sudo must be owned by uid 0 and have the setuid bit set”

It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error: "sudo must be owned ...
3
votes
1answer
1k views

Running Docker container as Root user

Running a Docker container process as root inside the container is considered insecure. But I have some doubts that I need to clear: Is it still the same kind of insecure even if the container cannot ...
37
votes
2answers
4k views

Why is SUID disabled for shell scripts but not for binaries?

While I understand the idea of SUID is to let an unprivileged user run a program as a privileged user, I have found that SUID usually doesn't work on a shell script without some workarounds. My ...