Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [privilege-escalation]

Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access throughout the environment

Filter by
Sorted by
Tagged with
1 vote
0 answers
26 views

Low level privilege assignment using Secedit failed

I, as Administrator, tried to assign Backup privileges to a sample user via secedit command... cmd> secedit /export /cfg config.inf It exported the contents of Local Security Policy (LSP) database ...
Aryan's user avatar
  • 21
1 vote
0 answers
255 views

Is a docker container that requires "clone" and "unshare" syscalls of any use?

I am not very skilled at linux and besides reading about clone and unshare I would love to have some second opinion on the situation: The setup A process I intend to run is an automated "chrome ...
Samuel's user avatar
  • 728
1 vote
0 answers
83 views

How can I exploit the following code using string format vulnerabilities, Global offset table & GDB? [closed]

The following code should be exploited and I need to exploit it in such a way that it runs my command (l33t) and there should be shellcode and exploit included, so that it runs my command. I believe I ...
A M's user avatar
  • 11
6 votes
3 answers
4k views

Escalating user privileges on Linux

I've been battling with one school task for a couple of days and can't seem to find any idea how to solve it. The task is pretty simple: On the server there is a secret.txt file in the /root folder, ...
Paul's user avatar
  • 95
1 vote
0 answers
144 views

Why is there no prevention of malicious polkit authentication agents?

A polkit authentication agent provides the user interface for administrators to input their password. It runs in user space. (https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html) An ...
Felix Ernst's user avatar
0 votes
0 answers
91 views

Proof of concept: Services File Permissions Weakness (T1574.010)

I am trying to do a proof of concept where I use technique T1574.010. In this technique, I should rewrite the binpath of some service in Windows 10 so that when the service starts again the payload ...
P00's user avatar
  • 1
0 votes
1 answer
225 views

Executable to try DLL hijacking attacks

I'm doing an educational project and I need an executable to try different DLL hijacking techniques in Windows 10. Obviously, there are no such vulnerabilities in Windows 10 by default, so I thought ...
P00's user avatar
  • 1
0 votes
1 answer
166 views

How to assess the Privilege Required?

I am calculating the CVSS score for an issue, and I am confused about the Privileges Required (PR). The issue is, for a client desktop app that connects to a server, the logged in user allows ...
ethicalhacker's user avatar
1 vote
1 answer
147 views

Does allowing binfmt_misc significantly increase the attack surface for unprivileged users that already can launch - native - binaries?

The Linux kernel lets me register and execute additional binary formats as if they were regular executables. I am thinking of this mostly as a convenience method, completing what specifying the ...
anx's user avatar
  • 370
0 votes
1 answer
219 views

Exporting shellcode to environment variable doesn't work as expected

(This is a question regarding a challenge in a wargame on overthewire.org called Narnia similar to Shellcode does not execute as the owner ) When exporting shellcode to EGG environment variable export ...
Black Hemera's user avatar
1 vote
0 answers
105 views

Is Android SOS being used as privilege escalation or settings bypass?

I have been getting random SOS countdowns triggered on my phone. Every time this happens, a pop-up appears telling me that unknown numbers have been temporarily unblocked. The most recent instance was ...
Miles's user avatar
  • 111
1 vote
0 answers
117 views

How to switch user instead of using uid? [closed]

In some methods of privilege escalation, if you want to be the root user, you write like this: setuid(0); setgid(0); And this is because the uid and gid of the root user is 0 id root uid=0 (root) ...
Freeman's user avatar
  • 241
1 vote
1 answer
424 views

Should an AWS Lambda trust-policy be narrowly scoped?

Should trust policies for AWS Lambda be narrowly scoped, and how can this be implemented (e.g. using Terraform)? Using Terraform I ran into a cyclic dependency problem as follows: an AWS Lambda ...
benjimin's user avatar
  • 175
1 vote
0 answers
102 views

How to gain admin access on windows [closed]

I've been trying to get admin on my own pc for probably like 4 years now and I still can't find anything. I tried to do the utilman swap with cmd but then literally my av blocked it and then it ...
Jake's user avatar
  • 11
2 votes
1 answer
262 views

Is this considered Privilege Escalation?

Suppose I have an Admin account and a normal user account. There is some functionality that is only accessible to the admin only, like promoting other users. In this scenario, I captured a request ...
infosec_learner's user avatar
0 votes
1 answer
244 views

Vulnerability in the source code, but can't elevate do Privilege Escalation

Playing a CTF, I am trying to gain access to level 3 (you have to gain access sequentially from level 1 to level 2 and so on...), and in the level 2 directory there's this source code 2.c and along ...
Fit Tony's user avatar
1 vote
1 answer
269 views

Rowhammer mitigations in current hardware and software

I've been looking into rowhammer attacks and mitigations and there are two (what seem to be) mitigations that I've seen that are actually implemented in currently available hardware and software, but ...
LanMan2-4601's user avatar
1 vote
2 answers
1k views

Abusing Shell Feature for Privilege Escalation

This was covered in Linux PrivEsc, task 15, in this TryHackMe room. I am having trouble understanding how this debugging mode is executing the commands in the PS4 variable, and why I must put /usr/...
questioner's user avatar
0 votes
1 answer
187 views

Legitimate use cases for writable etc/passwd files

I´m learning about linux privilege escalation via a writable /etc/passwd file and was wondering how common that actualy is? Are there any use cases where a regular user might have (or even needs) ...
Opera of the Phantom's user avatar
-1 votes
3 answers
379 views

What prevents Windows from being as secure as Linux? [duplicate]

According to wikipedia, Linux's security compared to Windows is generally due to "the malware's lack of root access." Why doesn't Windows just fix this?
atolnay's user avatar
0 votes
1 answer
288 views

Is there any way to disable/not allow unquoted service paths in Windows?

Unquoted service paths might be used as a privilege escalation vector after an attacker gains access to a Windows host. Given Hector's answer in the following question: "Windows Unquoted Search&...
4d4143's user avatar
  • 133
1 vote
1 answer
158 views

Can I escalate my privileges if I have read-write access to IAM service in AWS?

We are trying to convince folks in our company to grant developers full privileges to all services in "dev" account (current policy does not allow developers to create anything in our AWS ...
Kashyap's user avatar
  • 113
1 vote
0 answers
155 views

Why can't I access /tmp after my execve(/bin/sh) exploit? [closed]

I succesfully tried to exploit an old version of Apache. A shell is spawned with user www-data (id=33), but I can't "ls" or "cat" anything in /tmp. I can ls the contentns of /bin ...
hehehe's user avatar
  • 11
6 votes
3 answers
1k views

At which OS privilege level log4j usually runs?

Considering that a RCE vulnerability has been recently found in the log4j library, a library used in a lot more applications than I thought. The following question comes to my mind. If an attacker ...
pmbonneau's user avatar
  • 191
2 votes
2 answers
536 views

Privilege escalation : Is this step really necessary?

I understand the LD_preload trick, but in this tutorial(https://www.hackingarticles.in/linux-privilege-escalation-using-ld_preload/), they not only give the user the right to keep this environment ...
boredaf's user avatar
  • 143
0 votes
1 answer
556 views

Can a process executed as Root do ring 0 stuff?

I know that ring 0 is a CPU concept, but are processes running as root allowed to run instructions that require ring 0 such as changing the cr3 register for the page table ?
hehehe's user avatar
  • 3
2 votes
1 answer
232 views

Why is sudo's usage of timestamp files insecure?

Sudo and Opendoas on Linux use timestamp files to keep track of how long it's been since you've last entered your password. Doas on BSD uses a kernel feature instead. Why is the latter considered more ...
glibg10b's user avatar
  • 123
0 votes
1 answer
305 views

Understanding the Meltdown vulnerability

I need to write a simple program that demonstrates a race condition. I picked the Meltdown vulnerability. I want to clarify something. I'm following this explanation https://resources.infosecinstitute....
Segmentation fault's user avatar
1 vote
0 answers
135 views

Authorise access to hierarchical data

Consider a scenario in which you offer service access based on a hierarchy of authority. i.e., a HEAD can register his subordinates. The authenticated HEAD has the previledge to read and update data ...
Fahim Farook's user avatar
2 votes
1 answer
439 views

If browsing the web with root is dangerous, isn't browsing the web with a sudo enabled account only marginally safer?

If I get hit with malware while performing daily tasks (e.g. - checking email, web browsing, etc.) with a root shell, the malware will own my machine. If the aforementioned occurs whilst on a standard ...
OTM's user avatar
  • 143
-1 votes
1 answer
307 views

PowerShell - privilege escalation [closed]

In the past, I have used the Sherlock PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities. However, I am looking for a similar script, but I ...
Asparuh Gavrailov's user avatar
1 vote
1 answer
843 views

Secure way to run a linux binary which needs access to ressources only available to root?

As a developer, I ask how to approach security concerns regarding permissions of a binary which needs access to resources only available to root users. For example, let's think of a simple tool which ...
hypnomaki's user avatar
  • 111
0 votes
0 answers
812 views

Sudo -l systemctl bypass

I am trying to privilege escalate a vulnerable box and I've stuck with this output: sudo -l Matching Defaults entries for charlie on sewers: env_reset, mail_badpass, secure_path=/usr/local/...
saroglou's user avatar
2 votes
1 answer
1k views

SUID Priv Escalation - LD_LIBRARY_PATH versus ldconfig and /etc/ld.so.conf

Background Currently doing some vulnservers on Offensive Security's Proving Grounds Practice Labs. A vulnserver is a machine configured with vulnerabilities for testing/audit and research purposes. I ...
0x5929's user avatar
  • 355
1 vote
1 answer
224 views

How to fine tune timing for CVE-2021-3156 (sudo privilege escalation)?

I am trying to execute the sudo buffer overflow (CVE-2021-3156) on one of my systems, but haven't got it working yet. The system is definitely vulnerable (taking into account sudo version and sudoedit ...
Tom Atix's user avatar
  • 166
1 vote
0 answers
531 views

Spawning child processes from root using runuser command

I am working as an intern for an online coding platform startup (similar to LeetCode or HackerRank). The backend is written in Nodejs. Instead of running the code in a sandbox of some sort, the lead ...
Algo7's user avatar
  • 113
0 votes
2 answers
2k views

Is there a way to change your current UID to equal your EUID?

Here is the scenario: running id gives this : uid=1001(test1) gid=1001(test1) euid=1000(bl4ckc4t) groups=1001(test1) - This means that I am user test1, but my euid is set to another user. My goal is ...
Bl4ckC4t's user avatar
0 votes
1 answer
851 views

Privilege escalation using symlink [closed]

I am working on a "Hack me" challenge, I have access to apache account in the server, I tried to get root access, I run linpeas.sh script and linpeas didn't find anything special, however, ...
Sania Sadian's user avatar
1 vote
1 answer
2k views

How to run PrintSpoofer in memory from powershell?

PrintSpoofer uses named pipe impersonation to elevate on Windows 10 to SYSTEM from a user with SeImpersonatePrivilege (Local Service, Network Service, Administrator etc.). The compiled version is ...
PaperTsar's user avatar
  • 123
1 vote
1 answer
368 views

Prevent a remote privilege escalation when the root/admin password is known

Consider the following Linux system: root account is disabled (passwd -l root, passwd -d root), there is an account 'admin', with sudo rights, there is an account 'webservice', with limited ...
ndou's user avatar
  • 111
1 vote
2 answers
4k views

Sudo "/usr/sbin/halt", "/usr/sbin/reboot", "/usr/sbin/poweroff" - how to leverage it to privilege escalation?

A normal user can execute these commands as root without providing any password (sudo includes the full path of the command so path hijack isn't the case here), could "halt", "reboot&...
mansk1es's user avatar
2 votes
1 answer
320 views

Possible to inject in the middle of a ROOT NOPASSWD command with a wild card?

I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands ...
Duck's user avatar
  • 41
0 votes
2 answers
3k views

How safe is it to use SMB file share on a machine running up-to-date Windows 10 LTSC through the Internet?

Running Windows 10 LTSC. Forwarded 445 port on the router to Windows SMB. Assuming that: My machine has no viruses in it (fresh Windows installation) It has been updated to the latest OS release I am ...
infinitieunique's user avatar
1 vote
0 answers
144 views

Running non-root process in docker vs bare metal

Recently I faced argument that threw me a bit off balance. I've been suggested that running application bare metal is actually more secure than running it in container. Reasoning behind that is that ...
Lapsio's user avatar
  • 217
0 votes
1 answer
2k views

Exploit apache2 service as member of www-data group

I am attempting to solve a CTF challenge where I am logged in as a member of the www-data group and the apache2 service is misconfigured and can be run as sudo without a password. What I am attempting ...
retsek680's user avatar
1 vote
1 answer
651 views

Linux: Can unprivileged users tamper with processes running under their own identity?

Having the following pseudocode executed by a superuser, is it safe to assume that it is secure on Linux? if fork() == 0: # drop privileges to an unprivileged user, let's say "nobody" #...
1' OR 1 --'s user avatar
0 votes
0 answers
376 views

How can I use nohup command to get root access of the target machine?

I am playing ctf and I have gained access to the target machine but not as root. I can see nohup utility has root access on the machine and I used this command to get the root access but that did not ...
Hacker54's user avatar
1 vote
1 answer
230 views

Host filesystem manipulation from docker vs. virtual machine

When reading about docker, I found a part of the documentation describing the attack surface of the docker daemon. From what I was able to understand, part of the argument is that it is possible to ...
AlexV's user avatar
  • 111
0 votes
0 answers
144 views

Taking over Windows DC as a domain user

What do you suggest in order to take over a Windows Domain Controller, given the fact that you gained access to a domain user workstation and so you have domain user credentials? I have domain user ...
t5j's user avatar
  • 49
1 vote
2 answers
2k views

inject update-motd.d 00-header to run a script on ssh login

Is there a way to inject the 00-header to trigger a script that executes a shell upon ssh login. I'm facing a scenario where the 00-header has root privileges and I can modify it. I'm trying to have ...
David's user avatar
  • 95

1
2 3 4 5