# sudo + GTFObins

- [sudo /bin/bash](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/sudo-bin-bash.md): easy root
- [/bin/rpm](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/bin-rpm.md)
- [/usr/bin/gdb](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-gdb.md): GNU Debugger(GDB) has the suid bit and I can get the root shell with it.
- [/usr/bin/php7.2](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-php7.2.md)
- [sudo -u#-1 /bin/bash](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/sudo-u-1-bin-bash.md): Nice trick if you are logged in with an ssh user that doesn't have root privileges (but there is another one that does)
- [jjs](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/jjs.md): (strangely there is no need to start a nc listener from kali in another panel, redirects to root automatically)
- [/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.242.b08-0.el7\_7.x86\_64/jre/bin/java](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-lib-jvm-java-1.8.0-openjdk-1.8.0.242.b08-0.el7_7.x86_64-jre-bin-java.md): Try with other java versions, multi-step process
- [/usr/bin/vim](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-vim.md): One liner to get root:
- [/usr/bin/tee](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-tee.md): Two techniques listed, first one presupposes an ssh connection with a low priv user that can run /usr/bin/tee, second one is a standalone chain
- [/usr/bin/nice](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-nice.md): /bin/nice  (Vulnhub potato, presupposes low priv ssh users | /home/webadmin is the current directory in the box, change according to specific circumstances)
- [/usr/bin/dd](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-dd.md)
- [nmap](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/nmap.md): works even if nmap is not allowed sudo, last ditch attempt
- [/usr/bin/zip](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-zip.md)
- [/usr/bin/date](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-date.md)
- [/usr/bin/base32](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-base32.md): Reading private ssh key for root
- [/usr/sbin/hping3](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-sbin-hping3.md): Easy privesc
- [/usr/bin/cpulimit](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-cpulimit.md): Once you get the shell craft a simple C exploit on kali, then wget into target
- [/usr/bin/python](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-python.md): Easy root:
- [/etc/passwd](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/etc-passwd.md): Easy privesc
- [echo /bin/bash to executable file](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/echo-bin-bash-to-executable-file.md): If a script on target has root privileges, redirect a revshell and catch it with nc to get root
- [/usr/bin/find](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-find.md)
- [sudo\_inject](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/sudo_inject.md): Technique from PayloadAllTheThings
- [/bin/systemctl](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/bin-systemctl.md): Tried this one in practice but could not get a revshell
- [less](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/less.md)
- [/bin/ash](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/bin-ash.md)
- [awk](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/awk.md)
- [scp](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/scp.md)
- [man](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/man.md)
- [ftp](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/ftp.md)
- [knife](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/knife.md)
- [/usr/sbin/iftop](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-sbin-iftop.md)
- [/usr/bin/nano](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-nano.md)
- [ed](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/ed.md)
- [openssl (read file)](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/openssl-read-file.md)
- [tar](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/tar.md)
- [flock](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/flock.md)
- [expect](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/expect.md)
- [socat](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/socat.md)
- [Perl](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/perl.md)
- [/usr/bin/env](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-env.md)
- [strace](/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/strace.md)
