# Privesc

- [sudo + GTFObins](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins.md): Different privesc vectors abusing sudo
- [sudo /bin/bash](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/sudo-bin-bash.md): easy root
- [/bin/rpm](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/bin-rpm.md)
- [/usr/bin/gdb](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-gdb.md): GNU Debugger(GDB) has the suid bit and I can get the root shell with it.
- [/usr/bin/php7.2](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-php7.2.md)
- [sudo -u#-1 /bin/bash](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/sudo-u-1-bin-bash.md): Nice trick if you are logged in with an ssh user that doesn't have root privileges (but there is another one that does)
- [jjs](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/jjs.md): (strangely there is no need to start a nc listener from kali in another panel, redirects to root automatically)
- [/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.242.b08-0.el7\_7.x86\_64/jre/bin/java](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-lib-jvm-java-1.8.0-openjdk-1.8.0.242.b08-0.el7_7.x86_64-jre-bin-java.md): Try with other java versions, multi-step process
- [/usr/bin/vim](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-vim.md): One liner to get root:
- [/usr/bin/tee](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-tee.md): Two techniques listed, first one presupposes an ssh connection with a low priv user that can run /usr/bin/tee, second one is a standalone chain
- [/usr/bin/nice](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-nice.md): /bin/nice  (Vulnhub potato, presupposes low priv ssh users | /home/webadmin is the current directory in the box, change according to specific circumstances)
- [/usr/bin/dd](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-dd.md)
- [nmap](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/nmap.md): works even if nmap is not allowed sudo, last ditch attempt
- [/usr/bin/zip](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-zip.md)
- [/usr/bin/date](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-date.md)
- [/usr/bin/base32](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-base32.md): Reading private ssh key for root
- [/usr/sbin/hping3](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-sbin-hping3.md): Easy privesc
- [/usr/bin/cpulimit](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-cpulimit.md): Once you get the shell craft a simple C exploit on kali, then wget into target
- [/usr/bin/python](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-python.md): Easy root:
- [/etc/passwd](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/etc-passwd.md): Easy privesc
- [echo /bin/bash to executable file](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/echo-bin-bash-to-executable-file.md): If a script on target has root privileges, redirect a revshell and catch it with nc to get root
- [/usr/bin/find](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-find.md)
- [sudo\_inject](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/sudo_inject.md): Technique from PayloadAllTheThings
- [/bin/systemctl](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/bin-systemctl.md): Tried this one in practice but could not get a revshell
- [less](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/less.md)
- [/bin/ash](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/bin-ash.md)
- [awk](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/awk.md)
- [scp](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/scp.md)
- [man](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/man.md)
- [ftp](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/ftp.md)
- [knife](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/knife.md)
- [/usr/sbin/iftop](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-sbin-iftop.md)
- [/usr/bin/nano](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-nano.md)
- [ed](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/ed.md)
- [openssl (read file)](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/openssl-read-file.md)
- [tar](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/tar.md)
- [flock](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/flock.md)
- [expect](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/expect.md)
- [socat](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/socat.md)
- [Perl](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/perl.md)
- [/usr/bin/env](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-env.md)
- [strace](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/strace.md)
- [Docker privilege escalation](/pentesting-notes/r3dcl1ff/privesc/docker-privilege-escalation.md): Collection of docker specific privesc vectors
- [Kernel Exploits](/pentesting-notes/r3dcl1ff/privesc/kernel-exploits.md): Bunch of kernel exploits, mostly 'Nix targets
- [Compiling - General guidelines](/pentesting-notes/r3dcl1ff/privesc/kernel-exploits/compiling-general-guidelines.md)
- [Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27)](/pentesting-notes/r3dcl1ff/privesc/kernel-exploits/linux-kernel-less-than-4.13.9-ubuntu-16.04-fedora-27.md): pretty straightforward, just compile, transfer to target and fire off
- [LXD - Alpine](/pentesting-notes/r3dcl1ff/privesc/kernel-exploits/lxd-alpine.md)
- [Serv-U FTP Server < 15.1.7](/pentesting-notes/r3dcl1ff/privesc/kernel-exploits/serv-u-ftp-server-less-than-15.1.7.md)
- [\[CVE-2016-5195\] dirtycow 2](/pentesting-notes/r3dcl1ff/privesc/kernel-exploits/cve-2016-5195-dirtycow-2.md)
- [Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5...)](/pentesting-notes/r3dcl1ff/privesc/kernel-exploits/linux-kernel-2.6-less-than-2.6.19-white-box-4-centos-4.4-4.5....md)
- [Linux Kernel 2.6.39 "Mempodipper"](/pentesting-notes/r3dcl1ff/privesc/kernel-exploits/linux-kernel-2.6.39-mempodipper.md)
- [Samba 2.2.x - Remote buffer overflow](/pentesting-notes/r3dcl1ff/privesc/kernel-exploits/samba-2.2.x-remote-buffer-overflow.md): No need to edit the exploit , just supply the right parameters
- [Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition (Write Access Method)](/pentesting-notes/r3dcl1ff/privesc/kernel-exploits/linux-kernel-2.6.22-less-than-3.9-dirty-cow-proc-self-mem-race-condition-write-access-method.md): Unstable, might need to compile from host if gcc is not present on target
- [Full Nelson](/pentesting-notes/r3dcl1ff/privesc/kernel-exploits/full-nelson.md)
- [Exim 4.84-3 - Local Privilege Escalation](/pentesting-notes/r3dcl1ff/privesc/kernel-exploits/exim-4.84-3-local-privilege-escalation.md): You can write files as root or force a perl module to load by manipulating the perl environment and running exim with the "perl\_startup" arguement -ps.
- [Clown NewUser|Linux 3.0<3.3.5|](/pentesting-notes/r3dcl1ff/privesc/kernel-exploits/clown-newuser-or-linux-3.0-less-than-3.3.5-or.md): https://www.exploit-db.com/exploits/38390
- [fasync\_helper|Linux Kernel <2.6.28](/pentesting-notes/r3dcl1ff/privesc/kernel-exploits/fasync_helper-or-linux-kernel-less-than-2.6.28.md): https://www.exploit-db.com/exploits/33523
- [NFS no\_root\_squash/no\_all\_squash](/pentesting-notes/r3dcl1ff/privesc/kernel-exploits/nfs-no_root_squash-no_all_squash.md)
- ['Nix manual enumeration](/pentesting-notes/r3dcl1ff/privesc/nix-manual-enumeration.md): Assorted commands for Linux/'Nix manual enum
- [File transfers](/pentesting-notes/r3dcl1ff/privesc/file-transfers.md): File transfer techniques for post exploitation
- [Windows file transfers](/pentesting-notes/r3dcl1ff/privesc/file-transfers/windows-file-transfers.md): Various tricks to exfil exploits/enum scripts to Windows targets
- [Certutil](/pentesting-notes/r3dcl1ff/privesc/file-transfers/windows-file-transfers/certutil.md)
- [VBScript](/pentesting-notes/r3dcl1ff/privesc/file-transfers/windows-file-transfers/vbscript.md): Useful for older Systems |  Windows XP and 2003
- [Powershell](/pentesting-notes/r3dcl1ff/privesc/file-transfers/windows-file-transfers/powershell.md): Powershell option: 2006 and later versions
- [pyftpdlib](/pentesting-notes/r3dcl1ff/privesc/file-transfers/windows-file-transfers/pyftpdlib.md)
- [impacket](/pentesting-notes/r3dcl1ff/privesc/file-transfers/windows-file-transfers/impacket.md)
- [exe2hex](/pentesting-notes/r3dcl1ff/privesc/file-transfers/windows-file-transfers/exe2hex.md): Compress the binary to transfer, convert it to a hex string, and embed it into a Windows script.
- [php exfil | Win --> Kali](/pentesting-notes/r3dcl1ff/privesc/file-transfers/windows-file-transfers/php-exfil-or-win-greater-than-kali.md): Useful technique to exfil data from target to Kali
- [http transfers](/pentesting-notes/r3dcl1ff/privesc/file-transfers/windows-file-transfers/http-transfers.md): kali $ip: 10.10.10.10
- ['Nix file transfers](/pentesting-notes/r3dcl1ff/privesc/file-transfers/nix-file-transfers.md): kali $ip 10.10.10.10  | target $ip 10.11.11.11
- [Windows enumeration](/pentesting-notes/r3dcl1ff/privesc/windows-enumeration.md): Manual post exploitation recon for windows targets
- [Automated scripts](/pentesting-notes/r3dcl1ff/privesc/windows-enumeration/automated-scripts.md)
- [Wordpress privesc](/pentesting-notes/r3dcl1ff/privesc/wordpress-privesc.md): Wordpress specific tricks
- [OpenSSL privesc](/pentesting-notes/r3dcl1ff/privesc/openssl-privesc.md)
- [Privesc scripts | resources](/pentesting-notes/r3dcl1ff/privesc/privesc-scripts-or-resources.md): Collection of scripts and resources for privilege escalation/post exploitation
- [Linux Exploit suggester](/pentesting-notes/r3dcl1ff/privesc/privesc-scripts-or-resources/linux-exploit-suggester.md): Already part of linPEASS but might be good to run as standalone script for better accuracy
- [Vulmap](/pentesting-notes/r3dcl1ff/privesc/privesc-scripts-or-resources/vulmap.md): Python + Powershell script for CVE enumeration on localhost
- [vi](/pentesting-notes/r3dcl1ff/privesc/vi.md)
