Questions tagged [privilege-escalation]

Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access throughout the environment

Filter by
Sorted by
Tagged with
65 votes
4 answers

Are most Linux systems that allow non-root users to execute code straightforwardly rootable?

long story short if you can execute code on a box it is usually straightforward to get root (quote source) The immediate implication of this quote (if it's accurate) is that if you're running a ...
gaazkam's user avatar
  • 5,667
42 votes
2 answers

Is it possible to escalate privileges and escaping from a Docker container?

I'm learning a lot about docker. I'm practicing creating docker clusters using docker-swarm, registry, shipyard, etc. I saw how easy is to get root in a docker host machine once you entered to the ...
OscarAkaElvis's user avatar
193 votes
6 answers

Isn't Ubuntu's system prompt for my password spoofable?

Sometimes, Ubuntu shows the following window: This window can be caused by some background processes running, such as an automatic update, or a process which reports bugs to Canonical which manifests ...
Arseni Mourzenko's user avatar
28 votes
2 answers

Methods root can use to elevate itself to kernel mode

When most Linux users hear "root", they think of the maximum possible privilege on a computer. Some even think that root runs in ring 0. But in reality, root is just a regular user running in ring 3, ...
forest's user avatar
  • 65.8k
15 votes
2 answers

Is it secure to mount Veracrypt without sudo password in this way

Does this way have any security issues other than what's mentioned in that post? For reference: Create a new group called say veracryptusers and give it the necessary permissions to use VeraCrypt ...
user avatar
9 votes
1 answer

tty push back - priv escalation

I am trying to understand TTY push back better (assuming I am even using the correct terminology). from what I can determine through researching is that tty push back can allow a user to essentially ...
TheHidden's user avatar
  • 4,325
8 votes
2 answers

Am I affected by the Intel AMT/ISM/SBT escalation of privilege vulnerability?

I read about the security vulnerability that Intel explains here On other sites I have read that Intel Core-i CPUs are affected too and that Intel AMT has to do with the vPro name. Their guide on ...
comfreak's user avatar
  • 260
8 votes
2 answers

Escalating from Apache shell to root

I have one noob question.I tried to exploit shellshock on my Slackware linux server, but after I connect with reverse shell and User Agent I get that I am apache user and apache user don't have too ...
Vladimir's user avatar
  • 209
6 votes
3 answers

At which OS privilege level log4j usually runs?

Considering that a RCE vulnerability has been recently found in the log4j library, a library used in a lot more applications than I thought. The following question comes to my mind. If an attacker ...
pmbonneau's user avatar
  • 191
11 votes
4 answers

Privilege escalation using passwd file

If I have a world writeable /etc/passwd file on a system, how can I escalate my privileges to root? I am currently a underprivileged user. The underlying OS is CentOS 7.2 in case you are wondering I ...
Airbourne's user avatar
  • 271
10 votes
2 answers

Does shellshock produce a comprehensive local privilege escalation vector?

If setuid scripts take arbitrary environment variables, apart from a few black-listed ones like LD_LIBRARY_PATH, from the caller, does this not mean that any setuid script running #!/bin/bash directly ...
Ben's user avatar
  • 3,717
7 votes
2 answers

Do sudo and .profile/.bashrc enable trivial privilege escalation?

First of all, let me mention that I’m assuming a configuration as set up by current Linux desktop distributions (e. g. Debian, Fedora). I’m sure that there are methods which, if implemented, would ...
Socob's user avatar
  • 215
5 votes
1 answer

Is malware or screen capture possible with iMac as external display?

If using a foreign iMac as an external display (through the Thunderbolt to Thunderbolt, or Mini DisplayPort to Mini DisplayPort cable, and Command+F2 on the iMac, as per iMac Target Display Mode FAQ), ...
cnst's user avatar
  • 1,894
5 votes
1 answer

Automatically enumerate missing patches on penetration test

Nessus, when running a credentialed scan can check patch levels and return vulnerabilities when a package is one that hasn't been updated to the latest, non-vulnerable version. What is a good way of ...
SilverlightFox's user avatar
3 votes
0 answers

Exploiting Environment Variables in Scheduled Tasks for UAC Bypass

I am trying to escalate privileges from an ISS user on Windows Server 2012 R2 by exploiting Environment Variables in Scheduled Tasks for UAC Bypass as the following link explains the exploit: https://...
Lucian Nitescu's user avatar
2 votes
2 answers

ByPass usb GPO with iphone -and probably other mobile-

So I am running pentest on a device running Win7 and admin user set group policy to disable all mass storage devices and all usb's. I have access to local user without privs. Although my usb stick ...
cengizUzun's user avatar
2 votes
1 answer

Is there a list of safe/normal/expected SUID files?

Exploitable SUID executables are a basic privilege escalation vector. But just doing a search for all such files turns up a bunch of results on any linux system, most or all of which are presumed to ...
Yaakov Saxon's user avatar
2 votes
1 answer

Is there any authentication system whose protocol always notifies the "target account" of impersonation?

There are many forms of impersonation: Sudo in *nix Application impersonation (send as in Exchange) Any privileged user (helpdesk) logging in as a user so to not disclose the password RunAs ...
makerofthings7's user avatar
0 votes
1 answer

What's a least-privilege way to allow node.js to access network adapters on Linux?

Linux naturally restricts all but superuser from pulling traffic directly from network adapters. In the case of Wireshark/dumpcap, setuid root is used ONLY for dumpcap, restricting the privileges ...
bright-star's user avatar