>_ PwnAtlas

Search everything Ctrl K

Search everything

173 results for «sudo»

Techniques 1

Sudo abuse Linux privilege escalation · 61 machines

MITRE ATT&CK techniques 3

T1548.003 Sudo and Sudo Caching MITRE ATT&CK · Privilege Escalation, Defense Evasion
T1059.004 Unix Shell MITRE ATT&CK · Execution
T1574.007 Path Interception by PATH Environment Variable MITRE ATT&CK · Privilege Escalation, Persistence, Defense Evasion

Guides 14

Linux privilege escalation: sudo, SUID and capabilities The three checks that give the most roots on Hack The Box: what sudo lets you run, which binaries are SUID and which capabilities they carry, with the usual abuse for each case.
Reverse shell not connecting or dying: how to fix it Why a reverse shell never arrives, drops instantly or dies on Ctrl+C, how to troubleshoot it step by step, and how to turn it into a full terminal on Linux and Windows.
Linux kernel exploits: PwnKit, Dirty Pipe and OverlayFS When a kernel exploit makes sense, how to get the exact version, which exploits work in each range (PwnKit, Dirty Pipe, Baron Samedit, OverlayFS) and how to compile them.
Docker container escape: docker.sock and privileged mode How to tell you are inside a container, what to check and how to break out to the host with docker.sock, --privileged, mounted disks, capabilities or a vulnerable Docker.
Malicious file upload: bypassing upload filters to get a web shell Upload filter bypass step by step: alternative extensions, Content-Type, magic bytes, .htaccess and web.config, and finding where the file lands to run it.
OS command injection: detection, blind injection and filter bypasses How to find OS command injection on Linux and Windows, confirm it blind (time, DNS, HTTP) and bypass the most common space, keyword and character filters.
Kerberoasting and AS-REP Roasting: crackable hashes from Active Directory What makes an account vulnerable, how to request the tickets with Impacket, NetExec or Rubeus, how to crack them with hashcat, and the usual errors (clock, etype, usernames).
NTLM capture and relay: Responder, ntlmrelayx and coercion with PetitPotam Capture NetNTLMv2 hashes with Responder, learn when they can be relayed (SMB signing, LDAP, ADCS), use ntlmrelayx and coerce auth with PetitPotam.
SMB and NFS enumeration: shares, null sessions and files full of passwords Enumerate SMB and NFS with NetExec, smbclient, smbmap and enum4linux-ng, with or without credentials: null sessions, files with passwords and no_root_squash.
Active Directory enumeration: users, LDAP, BloodHound and password spraying What to do when you find a domain controller: enumerate without credentials, get valid users, spray passwords safely and collect BloodHound data.
MSSQL pentesting: xp_cmdshell, impersonation, linked servers and hash theft Attack SQL Server in a domain: connect with mssqlclient, run commands with xp_cmdshell, escalate with EXECUTE AS, abuse linked servers and steal hashes.
Insecure deserialization: spotting and exploiting it in Java, .NET, PHP, Python and Node.js Spot serialized data by its first bytes (rO0AB, AAEAAAD, O:, gASV), understand gadget chains and get RCE with ysoserial, ysoserial.net, phpggc and pickle.

Show all 14 →

Tools 1

linPEAS Script that checks every Linux privilege escalation path: sudo, SUID, capabilities, cron, credentials and kernel. Cheat sheet and HTB machines.

Resources and tools 2

Machines 61

Show all 61 →

Filter these machines by difficulty and OS →

Learning paths 1

Zero to OSCP Six stages in order, from your first nmap to a mock exam: Hack The Box machines, guides and cheat sheets to prepare for the OSCP without getting lost.

Checklists 3

Guide sections 9

Commands 78

Show all 78 →