Exploitation for Privilege Escalation
Exploiting a bug in the kernel, a service or a privileged binary to become root or SYSTEM.
How it shows up on Hack The Box
On HTB these are known kernel exploits (PwnKit, DirtyPipe), Windows service CVEs or custom binaries with buffer overflows, format strings or race conditions.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Linux kernel exploits: PwnKit, Dirty Pipe and OverlayFS 3 min read When a kernel exploit makes sense, how to get the exact version, which exploits work in each range (PwnKit, Dirty Pipe, Baron Samedit, OverlayFS) and how to compile them.
- Exploiting a public CVE: finding, reading and fixing exploits from searchsploit and GitHub 4 min read From a version number to a shell: identify the software, search searchsploit, GitHub and nuclei, read the exploit before running it and fix the broken ones.
- Linux buffer overflow step by step: ret2win and ret2libc with pwntools 4 min read From a crashing binary to a shell: checksec, finding the offset with cyclic, ret2win, bypassing NX with ret2libc and leaking libc to beat ASLR, with pwntools templates.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Linux privilege escalation › Exploitation
PwnKit (pkexec, CVE-2021-4034)
ls -l /usr/bin/pkexec && pkexec --version
DirtyPipe (5.8 to 5.16.11, CVE-2022-0847)
uname -r
Automatic suggestions
./linux-exploit-suggester.shWindows and Active Directory privilege escalation › Windows
System and patches
systeminfoGhidra › Triage before opening Ghidra
Binary protections
checksec --file=./binariopwntools › Offset
200-byte pattern
cyclic 200
Offset from the value that ends up in RIP/EIP
cyclic -l 0x6161616cNo command matches.