> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/walkthroughs-easy/common-linux-privesc.md). # Common Linux Privesc ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McoEmHcQkaUtJQoxs4t%2F-Mcp-1n2prvs1SujpaCo%2Fimage.png?alt=media\&token=30b49484-cf68-408e-8eb1-18a24d3428e7) ## Understanding Privilege Escalation ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McoEmHcQkaUtJQoxs4t%2F-Mcp-L438_OS3U4xE7oh%2Fimage.png?alt=media\&token=e18218ea-22a7-4f09-b097-f91673647192) ## Direction of Privilege Escalation ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McoEmHcQkaUtJQoxs4t%2F-Mcp-_CKFNCVpnOIxN33%2Fimage.png?alt=media\&token=0b4a7d06-56a8-4f47-b46c-5d9fc374cd78) ## Enumeration ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp-es03_lek8MlI8In%2F-Mcp-sjHrsCv3CdeKQ-w%2Fimage.png?alt=media\&token=bbfedb37-4143-4da3-8341-18eca5045dde) ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp-es03_lek8MlI8In%2F-Mcp-wBTxhcl7ZF6iYd4%2Fimage.png?alt=media\&token=65abd4be-d8ed-4cda-be17-48e8b6b7973d) ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp-es03_lek8MlI8In%2F-Mcp04xCb8EKJaSnvuJT%2Fimage.png?alt=media\&token=8e54684b-e9ad-4b9f-a9e0-5ac829416935) Lets login as user3 as they have told us. ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp-es03_lek8MlI8In%2F-Mcp0oD5Ye-4jfvKx7wA%2Fimage.png?alt=media\&token=ed2acbf7-7a12-4cd5-adfb-544630260419) The hostname is polobox ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp-es03_lek8MlI8In%2F-Mcp0vRzdjH_pzVdemPg%2Fimage.png?alt=media\&token=92e41536-1dbe-4895-9c0a-df44b394dc4b) Lets look at the /etc/passwd file ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp-es03_lek8MlI8In%2F-Mcp19GRUp2u4dwps7M4%2Fimage.png?alt=media\&token=2bf96d85-3a21-4017-b248-19fcb10ff1c8) ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp-es03_lek8MlI8In%2F-Mcp1D5zIF2FE4dgNif6%2Fimage.png?alt=media\&token=4dda30a6-5c64-4b6a-86b8-c8b8c5ca61ac) Lets look at how many shells there are on the machine ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp-es03_lek8MlI8In%2F-Mcp1cCOkWvCtJjcBOOT%2Fimage.png?alt=media\&token=e74bb806-f777-44b9-b2bc-442ae4282365) ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp-es03_lek8MlI8In%2F-Mcp1fqMHvBcCKuuybSj%2Fimage.png?alt=media\&token=dad321e7-3d46-4003-b0e1-cf94b8bfcc5e) Lets look at the cronjobs ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp-es03_lek8MlI8In%2F-Mcp1og6nwok2v4yUtkG%2Fimage.png?alt=media\&token=bb1cfb66-d319-4e0f-aec1-10d370e3a8ad) ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp-es03_lek8MlI8In%2F-Mcp1vhEvrEzj_9pq_eX%2Fimage.png?alt=media\&token=621d4438-db0e-426b-ac01-ae3842deb55e) The critical file that had its permissions changed is /etc/passwd ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp-es03_lek8MlI8In%2F-Mcp2QJsPmrQ28-AYS-y%2Fimage.png?alt=media\&token=64047da2-6f44-4362-ac5b-02d67cde43d6) ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp-es03_lek8MlI8In%2F-Mcp2TiE4vTDpLq0NB6z%2Fimage.png?alt=media\&token=59cc08d1-845f-4b4c-b01f-4d8ff27d4ae3) ## Abusing SUID/GUID Files ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp2V2gjs5BZPuyDQKc%2F-Mcp2m3UClj6fAz6XEHn%2Fimage.png?alt=media\&token=a85a5ae9-2a86-4a92-bfe1-365ca3f31484) ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp2V2gjs5BZPuyDQKc%2F-Mcp2p3O8bNO1xegY5Bn%2Fimage.png?alt=media\&token=564af70e-ded8-4ad1-9416-0e4602256279) Lets look for SUID files. ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp2V2gjs5BZPuyDQKc%2F-Mcp37rc5RmgAyiaiixE%2Fimage.png?alt=media\&token=e2fd8199-67b7-459f-80cc-b9c7aa2d52c2) ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp2V2gjs5BZPuyDQKc%2F-Mcp3PJdPO_hB4nQqd2x%2Fimage.png?alt=media\&token=8cdf90b7-204c-4bc0-ae59-19673100bddb) Lets run the file ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp2V2gjs5BZPuyDQKc%2F-Mcp3KluB--NboHKK3l1%2Fimage.png?alt=media\&token=985fd18a-50f8-4a59-974f-790dcf8d9f83) ## Exploiting Writeable /etc/passwd ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp3WSiA2VIA2QsB0Gi%2F-Mcp3aKojUKySlr11fzT%2Fimage.png?alt=media\&token=3b0f7772-15cf-4799-b7f7-7faed0dd84da) ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp3WSiA2VIA2QsB0Gi%2F-Mcp3dGZWul80YMADlHr%2Fimage.png?alt=media\&token=8c02da36-187c-4617-9258-19e325d93532) First lets switch users and create the hashed password ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp3WSiA2VIA2QsB0Gi%2F-Mcp6N6z4V8m_QnXaVSx%2Fimage.png?alt=media\&token=76e64853-6f14-4a86-82a3-082b60c2b7de) ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp3WSiA2VIA2QsB0Gi%2F-Mcp6SwK6TpznGCQTro9%2Fimage.png?alt=media\&token=e43abdef-5dfc-4dd1-a02e-c6618908fc99) Now lets edit the file and add the password ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp3WSiA2VIA2QsB0Gi%2F-Mcp6gz4rcGftH2JeHTm%2Fimage.png?alt=media\&token=9f43a712-d20c-417a-8e20-9dce5947d51e) ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp3WSiA2VIA2QsB0Gi%2F-Mcp6nq2Vcb6eZQUkSvs%2Fimage.png?alt=media\&token=c475934b-fe5f-4f8a-a59b-f9478daf1eae) Lets save the file and then login. ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp3WSiA2VIA2QsB0Gi%2F-Mcp6ttvwqNnmeaAsjjs%2Fimage.png?alt=media\&token=e1bd2164-182a-4485-a633-886784d7ed73) ## Escaping Vi Editor ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp3WSiA2VIA2QsB0Gi%2F-Mcp76kU0pMVwhhnGyRt%2Fimage.png?alt=media\&token=14ffd35f-c4d8-4a72-be79-2043902691b3) Lets follow the steps ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp3WSiA2VIA2QsB0Gi%2F-Mcp7IjA3LuODY6R684P%2Fimage.png?alt=media\&token=17079399-75c1-4a85-b2fe-d3a3ac21c031) ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp3WSiA2VIA2QsB0Gi%2F-Mcp7Q4l8z-ZBjQADHG4%2Fimage.png?alt=media\&token=adb18a31-da1e-4dbf-9dd3-5dc83ff86613) ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp3WSiA2VIA2QsB0Gi%2F-Mcp7dQIhNqNTGXWCO4d%2Fimage.png?alt=media\&token=18db901a-d80b-4cc7-be7b-53994391492f) ## Exploiting Crontab ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp3WSiA2VIA2QsB0Gi%2F-Mcp7kRtueYrxuA_GcJv%2Fimage.png?alt=media\&token=d4c8f8ce-2181-4804-b089-5e5735e1b8ca) ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp7lyJ9BtP1yGKuBbD%2F-Mcp7uB9OafOTAiHr6iQ%2Fimage.png?alt=media\&token=b53c0def-9727-4dc1-b424-4e2e5d60957c) Lets follow the steps First we create the msfvenom payload on our machine ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp7lyJ9BtP1yGKuBbD%2F-Mcp8g_65rjtnN_Dkn66%2Fimage.png?alt=media\&token=8e340fee-c3d7-4495-80a6-f2af309c4e17) ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp7lyJ9BtP1yGKuBbD%2F-Mcp8sN8cF0TWnr_S7tf%2Fimage.png?alt=media\&token=13e81958-f717-4d61-9bbd-f3a216ecf140) Now lets find where the autoscript.sh file is located ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp7lyJ9BtP1yGKuBbD%2F-Mcp8w2jp-02byKARitt%2Fimage.png?alt=media\&token=a00d9096-51e2-4f30-9a91-bf6210371aea) ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp7lyJ9BtP1yGKuBbD%2F-Mcp944UwTeed4PDPwXk%2Fimage.png?alt=media\&token=b5649610-4e78-41ba-a306-dfe166594bab) Lets echo the shell into the file and start a netcat listener ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp7lyJ9BtP1yGKuBbD%2F-Mcp9PKNogjiRwSLr0nl%2Fimage.png?alt=media\&token=9fa1a3b3-18f2-4644-b7cd-1f0844c39dca) ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp7lyJ9BtP1yGKuBbD%2F-Mcp9Rx987T8EGjvg_1r%2Fimage.png?alt=media\&token=b33d3176-f341-4c3e-bcb2-e04b8baa51a2) After a while you should get a reverse shell ## Exploiting PATH variable ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mcp7lyJ9BtP1yGKuBbD%2F-Mcp9zHWliTAsAKYMWAR%2Fimage.png?alt=media\&token=0ac75a1a-3e2a-44d8-9ac9-1a5e151f12ec) Lets follow the steps ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McpAUqDcepKonIv1HfP%2F-McpFUrFpRHk1MG-nRJE%2Fimage.png?alt=media\&token=c428079a-ad18-46eb-b94e-043bd33b13ab) ![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McpAUqDcepKonIv1HfP%2F-McpG3FGcC0Q-4zoRUJy%2Fimage.png?alt=media\&token=976f4fc8-bbed-40ac-a068-577f896adf99)