Understanding Privilege Escalation
Direction of Privilege Escalation
Lets login as user3 as they have told us.
The hostname is polobox
Lets look at the /etc/passwd file
Lets look at how many shells there are on the machine
Lets look at the cronjobs
The critical file that had its permissions changed is /etc/passwd
Abusing SUID/GUID Files
Lets look for SUID files.
Lets run the file
Exploiting Writeable /etc/passwd
First lets switch users and create the hashed password
Now lets edit the file and add the password
Lets save the file and then login.
Escaping Vi Editor
Lets follow the steps
Exploiting Crontab
Lets follow the steps
First we create the msfvenom payload on our machine
Now lets find where the autoscript.sh file is located
Lets echo the shell into the file and start a netcat listener
After a while you should get a reverse shell
Exploiting PATH variable
Lets follow the steps
