Questions tagged [privilege-escalation]

Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access throughout the environment

Filter by
Sorted by
Tagged with
0
votes
1answer
66 views

How do I know/find out about Minecraft Server Vulnerabilities?

I remember playing Minecraft (Java-we're only talking about Minecraft Java on the computer here) at like 13-14 years old, and having this server owner claim that the server has been hacked, and that ...
-3
votes
0answers
34 views

What is the best way to upgrade a netcat low priv shell into a high priv shell [closed]

So say I ran a python reverse shell script on a victim machine and caught the connection on my machine using netcat -nvlp 4444. What would be the best way to upgrade this shell? Is there a way to ...
0
votes
1answer
67 views

What does the following lines of code mean? Can anyone explain step by step? [closed]

I'm still learning and this was a part of using systemctl for privilege escalation. eop=$(mktemp).service echo '[Service] ExecStart=/bin/sh -c "cat /root/root.txt > /tmp/output" [Install] ...
0
votes
1answer
54 views

Does sudo ever de-escalate privilege while the program/command/service is running?

For Example Is it safer to do: $ sudo [cmd] [args] [enter user password] or $ su - [enter root password] # [cmd] [args] I always assumed they are the exact same thing, because sudo utilizes ...
-1
votes
0answers
9 views

what are functional accounts in active directory? [migrated]

I am aware that functional accounts are accounts used to perform automated account management functions. are they like service accounts which are used to by applications or processes?
2
votes
2answers
1k views

Privilege Escalation Wordpress

I have access to a Wordpress blog and want to read the server's /root directory that belongs to the user "root" and not "www-data". I also know his password, but I can't open an interactive shell to ...
0
votes
2answers
132 views

Exectuting sudo command in one line within a non-tty shell

I have access to a server via RCE over http. I can send post requests to the server which results in command execution. I am attempting to escalate privileges via sudo (su is not installed). The ...
1
vote
2answers
206 views

sudo whitelist just program perl

In visudo Ubuntu I whitelist this program myuser ALL=(root) NOPASSWD:/myuser/program.pl when I run sudo /myuser/program.pl I get prompt to set password. The solution is to add to visudo /usr/bin/...
0
votes
0answers
46 views

Bypassing non-writeable permissions on Ubuntu server

Say I have gained RCE on a server which has a firewall blocking all egress traffic: Linux cmweb6 4.15.0-1040-azure #44-Ubuntu SMP Thu Feb 21 14:24:01 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux But I am ...
0
votes
0answers
390 views

Powershell (WinRM) and cmd.exe: reg query output deviation

during a CTF I encountered the following anomaly regarding PS & cmd.exe: I got access to a Windows x86 server through WinRM Port 5985 using evil-winrm. (https://github.com/Hackplayers/evil-winrm) ...
1
vote
3answers
172 views

Why doesn't nordvpn require sudo?

I've downloaded and installed nordvpn on Ubuntu and am a bit incredulous at its operation. After I downloaded its .deb file and installed it, apparently it can be activated with the command nordvpn ...
6
votes
1answer
465 views

How to execute a command directly on the host system through docker.sock in a Docker container?

I've been studying Docker security and examining ways of escaping from container to host. Suppose Docker sock (docker.sock) is mounted into the container at /var/run/docker.sock, so that Docker ...
1
vote
1answer
111 views

Why not use sudo instead of setuid/setgid?

If it is an insecure practise to use setuid/setgid binaries, why do distributions, OSes force it? The big question: what prevents using sudo instead of the setuid/setgid binaries? "ping" would be ...
16
votes
1answer
6k views

How to do a privileges escalation with ping?

I am trying to achieve a privilege escalation. I have a virtual machine on Linux and I escaped from an rbash terminal. I have now a "normal" user terminal. My user is not in the sudoers file. Is it ...
-1
votes
1answer
192 views

Privilege escalation modifying cookie

I have two accounts, an administrator and a simple user. I can capture the administrator's cookie and use it in a simple user request, I find myself logged in with the administrator user and then log ...
7
votes
4answers
1k views

Does the new Fedora package manager allow unauthorized installations?

I just upgraded to Fedora 22. The biggest change from the previous version is that the yum package manager is now replaced with dnf. One change I've noticed is that if you try to execute a command ...
12
votes
5answers
505 views

How can one tell if a binary is safe to give sudo permissions for to an untrusted user?

sudo is sometimes used to give untrusted or "semi-trusted" users the ability to perform certain tasks as root, while not giving them unlimited root access. This is usually done via an entry into /etc/...
5
votes
1answer
365 views

Is malware or screen capture possible with iMac as external display?

If using a foreign iMac as an external display (through the Thunderbolt to Thunderbolt, or Mini DisplayPort to Mini DisplayPort cable, and Command+F2 on the iMac, as per iMac Target Display Mode FAQ), ...
0
votes
0answers
33 views

Unquoted Service Path with Windows Short Filename ( 8.3 filename convention)

So if there is a service which has executable path as below. Path to executable : C:\PROGRA~1\ABCSOFT~\service.exe Here the path is shortened using "8.3 filename" convention and the actual complete ...
1
vote
0answers
98 views

Sudo parameterised all commands, is this secure? [closed]

About this question sudo white list just program perl I think I found possible solution using just sudo have a program Perl and make executable chmod + x in sudo whitelist that program and ...
0
votes
0answers
107 views

set-guid exploit of a program with relative path

I'm trying to exploit a program which has the set-guid bit enabled. The program is simple it contains the following (stage.c): #include <stdio.h> #include <stdlib.h> #include <unistd....
27
votes
2answers
2k views

Methods root can use to elevate itself to kernel mode

When most Linux users hear "root", they think of the maximum possible privilege on a computer. Some even think that root runs in ring 0. But in reality, root is just a regular user running in ring 3, ...
12
votes
2answers
3k views

Is it secure to mount Veracrypt without sudo password in this way

Does this way have any security issues other than what's mentioned in that post? For reference: Create a new group called say veracryptusers and give it the necessary permissions to use VeraCrypt ...
0
votes
0answers
231 views

DLL Hijacking doesn't work (DLL Proxy technique)

I found DLL Hijacking vulnerability in a program. It doesn't load VERSION.dll properly. Then I try to use DLL Proxying technique. I try to create malicious DLL with C++. This is my code: #pragma ...
6
votes
1answer
390 views

Can any of the INTEL-SA-00086 vulnerabilities be exploited by an unprivileged user?

Several of the latest Intel Management Engine vulnerabilities are listed as local vulnerabilities, allowing code executing on the system to elevate its privileges to ME context. One of them (CVE-2017-...
1
vote
1answer
1k views

Exploiting cron job running as root

There is a cron job running as root on a web server every 15 minutes: php cli-script.php (cli stands for "Command Line Interface", so is only accessible from command-line) It is not possible to ...
0
votes
1answer
61 views

Do world-writable systemd .service files created as symbolic links in /etc/systemd/system impose a security threat? [closed]

Do world-writable systemd .service files created as symbolic links in /etc/systemd/system impose a security threat? Would it be possible to somehow modify the links to target arbitrary .service files ...
2
votes
3answers
10k views

How to gain root privilege after injecting code using a buffer overflow vulnerability?

Once the attacker finds an exploitable vulnerability in a user program, e.g., buffer overflow. Assume his goal is to gain root privilege and typical countermeasures are not present in the system (ASLR,...
2
votes
1answer
88 views

Is it ok to let someone unlock their own account with their admin account?

Scenario: Person A's normal computer account is personA. They have locked this out with too many bad password attempts. The user is part of the IT group, so they also have an admin account: personA-...
1
vote
1answer
50 views

Finding applications vulnerable to dll preloading on windows

An application is vulnerable to DLL preloading attack on Windows if it loads a DLL simply by it's name. Windows then goes on to search several folders and loads the first DLL with a matching name. ...
2
votes
2answers
371 views

Privilege Escalation TTY error while using sudo /usr/bin/vi command [closed]

I am currently trying to escalate my privileges on an Ubuntu box. When I enumerated the server and run "sudo -l" command, I found out /usr/bin/vi set to (root) NOPASSWD. (root) NOPASSWD: /usr/bin/vi /...
1
vote
1answer
2k views

Why doesn't my systemctl command work? [closed]

I'm working on a pentest VM, and have elevated my user privileges to that of a common user. I can see from my enumeration scans that systemctl has a SUID bit set, and has the ownership group listed as ...
0
votes
1answer
482 views

Django admin site privilege escalation

Last night, I read a PDF detailing a privilege escalation attack a researcher had performed on a Django admin site. I'm curious- was the unfortunate application susceptible to this attack due to a ...
2
votes
1answer
476 views

sudo restrictions circumvention with pkexec: root shell

I had corrupted my sudo setup. With no possibility to login as root (locked root account, broken sudo), a search made it clear: use pkexec. It worked. So far, so good. But that turns out to be a big ...
1
vote
1answer
4k views

How can privilege escalation through pkexec be prevented?

I've managed to elevate privileges on a Linux machine (3.19) using pkexec, but I don't understand the mechanics. /usr/bin/pkexec has the SUID bit set (which is normal, I gather), and simply using it ...
5
votes
1answer
120 views

How can a bad process obtain root by waiting for a user to run a command as sudo?

A comment on this answer states: The whole linux desktop provides very little protection against bad processes running as the user. A bad process could just watch the keyboard input and wait for ...
0
votes
0answers
48 views

What is possible with a non-administrative users Ticket Granting Ticket and/or NTLM hash?

During a penetration test, if a users NTLM hash or a valid Kerberos TGT is compromised, what attacks are possible if the user is not an administrator on any (in scope) workstations? For instance, it ...
3
votes
2answers
644 views

Privileges needed to perform process injections

I am reading about process injection techniques on Windows machines (originally came to this from privilege escalation research). Although I used Windows for the majority of my life, I feel like I ...
1
vote
1answer
126 views

Harden against privilege escalation in Microservices

Please consider the following scenario. The system has a set of business owners (i.e. users of the system) Each business owner is mapped to a set of customers The business owners login to the system ...
6
votes
2answers
370 views

Bash function manipulation explained

I was recently reading through a write up on a capture the flag Linux VulnHub machine. For privilege escalation, the author references 'bash function manipulation'. A Google search turns up very ...
22
votes
3answers
16k views

Bank complains about rooted Android. Is it really any worse than a Windows desktop?

When I use my bank's Android application, the app notices that my phone is rooted and puts up a message with a big red "danger" symbol and a message saying "vulnerable device." I totally understand ...
0
votes
1answer
446 views

Why in LD_PRELOAD exploit we call unsetenv(LD_PRELOAD)?

Why to exploit LD_PRELOAD like is shown here https://touhidshaikh.com/blog/?p=827 in the .c file the first instruction is unsetenv(LD_PRELOAD)? Is it a routine action which all shared libraries do? Or ...
1
vote
1answer
145 views

Using SUID program to avoid having entries in sudoers

Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
1
vote
2answers
290 views

What is the difference between “missing function level access control” and “privilege escalation”?

I was going through a web application from my account and I was able to view some confidential information about my other account. I want to know if this is a case of missing function level access ...
10
votes
3answers
31k views

Privilege escalation using passwd file

If I have a world writeable /etc/passwd file on a system, how can I escalate my privileges to root? I am currently a underprivileged user. The underlying OS is CentOS 7.2 in case you are wondering I ...
64
votes
4answers
13k views

Are most Linux systems that allow non-root users to execute code straightforwardly rootable?

long story short if you can execute code on a box it is usually straightforward to get root (quote source) The immediate implication of this quote (if it's accurate) is that if you're running a ...
1
vote
1answer
852 views

Get the privileges of root with the user with I do an exploit with Shellshock [closed]

I got the remote control of a linux machine with Shellshock attack in Kali Linux (attacker machine) to a TinyCore Linux (victim machine), I used this module to attack the CGI vulnerability: use ...
33
votes
2answers
32k views

Is it possible to escalate privileges and escaping from a Docker container?

I'm learning a lot about docker. I'm practicing creating docker clusters using docker-swarm, registry, shipyard, etc. I saw how easy is to get root in a docker host machine once you entered to the ...
1
vote
2answers
122 views

Privilege Escalation On Shared Server [closed]

I recently did a ca /etc/passwd And it revealed many accounts and their respective directories. Is my shared server secure? Does this tell anything? Can a good hacker access my directory from ...
3
votes
1answer
4k views

How to use a sh SUID script to get privilege escalation?

As www-data user (non-privileged user) I have found this SUID, world-writable shell script: www-data@Cisco:/home/cripto$ ls -al /etc/init.d/admin -rwsr-xrwx 1 root bob 233 Nov 12 13:09 /etc/init.d/...