Questions tagged [privilege-escalation]
Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access throughout the environment
19
questions
65
votes
4
answers
13k
views
Are most Linux systems that allow non-root users to execute code straightforwardly rootable?
long story short if you can execute code on a box it is usually straightforward to get root
(quote source)
The immediate implication of this quote (if it's accurate) is that if you're running a ...
- 5,667
42
votes
2
answers
39k
views
Is it possible to escalate privileges and escaping from a Docker container?
I'm learning a lot about docker. I'm practicing creating docker clusters using docker-swarm, registry, shipyard, etc.
I saw how easy is to get root in a docker host machine once you entered to the ...
- 5,235
193
votes
6
answers
30k
views
Isn't Ubuntu's system prompt for my password spoofable?
Sometimes, Ubuntu shows the following window:
This window can be caused by some background processes running, such as an automatic update, or a process which reports bugs to Canonical which manifests ...
- 4,684
28
votes
2
answers
3k
views
Methods root can use to elevate itself to kernel mode
When most Linux users hear "root", they think of the maximum possible privilege on a computer. Some even think that root runs in ring 0. But in reality, root is just a regular user running in ring 3, ...
- 65.8k
15
votes
2
answers
7k
views
Is it secure to mount Veracrypt without sudo password in this way
Does this way have any security issues other than what's mentioned in that post?
For reference:
Create a new group called say veracryptusers and give it the necessary permissions to use VeraCrypt ...
Guesting
9
votes
1
answer
2k
views
tty push back - priv escalation
I am trying to understand TTY push back better (assuming I am even using the correct terminology).
from what I can determine through researching is that tty push back can allow a user to essentially ...
- 4,325
8
votes
2
answers
5k
views
Am I affected by the Intel AMT/ISM/SBT escalation of privilege vulnerability?
I read about the security vulnerability that Intel explains here
On other sites I have read that Intel Core-i CPUs are affected too and that Intel AMT has to do with the vPro name.
Their guide on ...
- 260
8
votes
2
answers
38k
views
Escalating from Apache shell to root
I have one noob question.I tried to exploit shellshock on my Slackware linux server, but after I connect with reverse shell and User Agent I get that I am apache user and apache user don't have too ...
- 209
6
votes
3
answers
851
views
At which OS privilege level log4j usually runs?
Considering that a RCE vulnerability has been recently found in the log4j library, a library used in a lot more applications than I thought. The following question comes to my mind.
If an attacker ...
- 191
11
votes
4
answers
52k
views
Privilege escalation using passwd file
If I have a world writeable /etc/passwd file on a system, how can I escalate my privileges to root? I am currently a underprivileged user. The underlying OS is CentOS 7.2 in case you are wondering
I ...
- 271
10
votes
2
answers
9k
views
Does shellshock produce a comprehensive local privilege escalation vector?
If setuid scripts take arbitrary environment variables, apart from a few black-listed ones like LD_LIBRARY_PATH, from the caller, does this not mean that any setuid script running #!/bin/bash directly ...
- 3,717
7
votes
2
answers
2k
views
Do sudo and .profile/.bashrc enable trivial privilege escalation?
First of all, let me mention that I’m assuming a configuration as set up by current Linux desktop distributions (e. g. Debian, Fedora). I’m sure that there are methods which, if implemented, would ...
- 215
5
votes
1
answer
481
views
Is malware or screen capture possible with iMac as external display?
If using a foreign iMac as an external display (through the Thunderbolt to Thunderbolt, or Mini DisplayPort to Mini DisplayPort cable, and Command+F2 on the iMac, as per iMac Target Display Mode FAQ), ...
- 1,894
5
votes
1
answer
2k
views
Automatically enumerate missing patches on penetration test
Nessus, when running a credentialed scan can check patch levels and return vulnerabilities when a package is one that hasn't been updated to the latest, non-vulnerable version.
What is a good way of ...
- 33.8k
3
votes
0
answers
1k
views
Exploiting Environment Variables in Scheduled Tasks for UAC Bypass
I am trying to escalate privileges from an ISS user on Windows Server 2012 R2 by exploiting Environment Variables in Scheduled Tasks for UAC Bypass as the following link explains the exploit:
https://...
- 1,830
2
votes
2
answers
2k
views
ByPass usb GPO with iphone -and probably other mobile-
So I am running pentest on a device running Win7 and admin user set group policy to disable all mass storage devices and all usb's.
I have access to local user without privs.
Although my usb stick ...
- 616
2
votes
1
answer
1k
views
Is there a list of safe/normal/expected SUID files?
Exploitable SUID executables are a basic privilege escalation vector. But just doing a search for all such files turns up a bunch of results on any linux system, most or all of which are presumed to ...
- 158
2
votes
1
answer
126
views
Is there any authentication system whose protocol always notifies the "target account" of impersonation?
There are many forms of impersonation:
Sudo in *nix
Application impersonation (send as in Exchange)
Any privileged user (helpdesk) logging in as a user so to not disclose the password
RunAs ...
- 50.6k
0
votes
1
answer
689
views
What's a least-privilege way to allow node.js to access network adapters on Linux?
Linux naturally restricts all but superuser from pulling traffic directly from network adapters. In the case of Wireshark/dumpcap, setuid root is used ONLY for dumpcap, restricting the privileges ...
- 147