# Linux Privilege Escalation for Beginners

## Why this Course?

* To gain a better understanding of privilege escalation techniques.
* To Improve Capture the Flag skill-set.
* To prepare for certification courses.

The goal is to learn how to enumerate Linux machines manually, and with automated tools so that we can discover how to elevate our privileges.

## Initial Enumeration

### System Enumeration

We want to find out the kernel version we are running on, whether its vulnerable to anything, and also the CPU architecture.

`hostname`

`uname -a`

`cat /proc/version`

`cat /etc/issue`

![Sys enum](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeQW9TJSpWS1Fa3FvX-%2F-MeQWcV79XkPz5XaaiPM%2Fsysenum.png?alt=media\&token=5195617e-025f-4aa3-8934-19439612eeae)

View CPU Architecture: `lscpu`

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeQW9TJSpWS1Fa3FvX-%2F-MeQWij32xA_HBt053C-%2Flscpu.png?alt=media\&token=3fff5e56-4fea-4a2b-b59a-9de96ec56e16)

View services running (Task Manager in Windows):

`ps aux`

We can grep to filter for certain services e.g. cron, apache, etc. We can also filter services by the user running them.

&#x20;`ps aux | grep TCM`

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeQW9TJSpWS1Fa3FvX-%2F-MeQWvd-GyN9yIDnT4Ti%2Fps_aux_grep.png?alt=media\&token=44730890-e5aa-415b-9182-a594120806c3)

### User Enumeration

We do this to find out:

* Who we are
* The permissions we have.
* What we are capable of doing.

Some commands to find out which user we are:&#x20;

`whoami`

`id`

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeQW9TJSpWS1Fa3FvX-%2F-MeQXHG8GEyUa5oti271%2Fwhoami.png?alt=media\&token=df83a6a2-4945-428a-ae16-1ba1f2787c12)

We can use the sudo command to find out which privileges we have.

`sudo -l`

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeQW9TJSpWS1Fa3FvX-%2F-MeQXMiaVnvZDD1EeFlA%2Fsudo%20permissions.png?alt=media\&token=e8882b4d-ee89-49d3-800f-a37f013561ec)

By viewing the /etc/passwd file, we can discover other users of the machine.

![/etc/passwd file](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeQXZ2A9gel-pU5ArPe%2F-MeQYXOCgqG5KN2266Hc%2Fimage.png?alt=media\&token=40fb25bf-1337-4147-9815-b1d3db03277f)

To view users only, we can use the command below:

`cat /etc/passwd | cut -d : --f 1`

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeQXZ2A9gel-pU5ArPe%2F-MeQYpjigdZEp9LIrCg2%2Fimage.png?alt=media\&token=875fd41e-8ad9-4eae-a4b8-1fa134e67b18)

It's also important to check if we can view the /etc/shadow and /etc/group files.

We can use the `history` command to have a look at the last few commands run. We might find something interesting e.g, *passwords* :)

![History Command](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeQXZ2A9gel-pU5ArPe%2F-MeQ_KZHulWw9MRp1TZs%2Fimage.png?alt=media\&token=49ceea3a-32dc-43a7-8c63-db4ab254c107)

Can we escalate into another user?

`sudo su -`

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeQXZ2A9gel-pU5ArPe%2F-MeQ_tyOHAuviRGScla4%2Fimage.png?alt=media\&token=109ecf95-0eee-4b89-87f0-ebc9bc50cabc)

No we cannot :)

### Network Enumeration

Helps us understand:

* What our IP architecture is.
* See what ports may be open internally but not externally.
* See what we are interacting with.

`ifconfig`

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeQXZ2A9gel-pU5ArPe%2F-MeQbGxzgtWI8V0WITnl%2Fimage.png?alt=media\&token=77226020-670c-4ea2-9d51-8fee7b41bed0)

`ip a`&#x20;

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeQXZ2A9gel-pU5ArPe%2F-MeQbRjWL76iU-eqtSDB%2Fimage.png?alt=media\&token=bd18ef80-4afe-4e40-ba6f-d05d42982465)

`route`

`ip route`

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeQXZ2A9gel-pU5ArPe%2F-MeQbtLWTgoBT-ljxCwA%2Fimage.png?alt=media\&token=4a62c548-ac82-4ed9-a449-fdc64968528e)

`arp -a`

`ip neigh`

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeQXZ2A9gel-pU5ArPe%2F-MeQcBUgxAEhe24OM4Lz%2Fimage.png?alt=media\&token=3278ffb0-bdd4-4ec7-8a0f-0a1405ca74b2)

`netstat -ano`

### Password Hunting

`grep --color=auto -rnw '/' -ie "PASSWORD=" --color=always 2> /dev/null`

Locate the word *password* in a file name

`locate password | more`

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeQXZ2A9gel-pU5ArPe%2F-MeQfO2JGxTz52UV2IBj%2Fimage.png?alt=media\&token=fff9f063-cf65-4383-9d65-803275752b68)

We can replace 'password' with 'pass', 'pwd', 'passwd', 'api', etc.

It's also a good idea t search for ssh keys.

`find / -name id_rsa 2> /dev/null`

or

`find / -name authorized_keys 2> /dev/null`

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeQfRQes24yx8QBQ_mF%2F-MeQgikgNwzLY0SA3oNL%2Fimage.png?alt=media\&token=af9bdf82-367b-42b4-83b4-4b94ee70d02d)

## Exploring Automated Tools

* LinPEAS - Linux Privilege Escalation Awesome Script: <https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS>
* LinEnum: <https://github.com/rebootuser/LinEnum>
* Linux-Exploit-Suggester: <https://github.com/mzet-/linux-exploit-suggester>
* Linuxprivchecker.py: <https://github.com/sleventyeleven/linuxprivchecker>

## Escalation Paths

### Kernel Exploits

&#x20;Kernel Exploits - <https://github.com/lucyoa/kernel-exploits>

![Kernel Overview](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeTcT5ZqC3wkkECs95L%2F-MeTd7V8wncAEUiCxrZb%2Fimage.png?alt=media\&token=695a5e9f-09c5-4331-b622-3d5c2afb2557)

The kernel is a computer program that controls everything in the system. It facilitates interactions between hardware and software components. It acts as a translator.

Let us use the *dirtycow* exploit to escalate our privileges.

![Dirty Cow Exploit](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeTcT5ZqC3wkkECs95L%2F-MeTgn7gghVa51CTFXh7%2Fimage.png?alt=media\&token=9a3d7e24-bb43-4d30-8c36-5598de047d5d)

We are now root.

### Passwords & File Permissions

#### Escalation via Stored Passwords

We can use the `history` command to find out if any passwords were input in the terminal.

![MySQL username and password](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeTiI_elJfMNc8mv6z8%2F-MeTwPY40FQMjrxUGttg%2Fimage.png?alt=media\&token=c9fce9aa-11e5-4157-b1dc-202551fff8e7)

We can also view `.bash_history` using `nano .bash_history.`

![.bash\_history](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeTiI_elJfMNc8mv6z8%2F-MeTwsD2nqU7wBvAclVz%2Fimage.png?alt=media\&token=31b432b6-358d-42c4-b846-9731befc8340)

We can use:

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Privilege%20Escalation.md#looting-for-passwords>" %}

#### Escalation via Weak File Permissions

Do we have access to a file we "shouldn't"? Can we modify it? Can we execute it?

As a regular user, we should NOT have read access to the /etc/shadow file. Why? We can view the hashes and take them offline to attempt to crack them.

![File Permissions](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeTzXChpucirOOWHnNx%2F-MeU09_vv5bqHzYqVqdd%2Fimage.png?alt=media\&token=15e476f4-610e-4436-8362-a9eab8303e47)

Assuming we had read write privileges, we could delete the 'x' placeholder for the root user in the /etc/passwd file file. This will remove the password for the root user and we could switch to them.

Alternatively, we could delete the root hash in the /etc/shadow file and replace it with a hash that we know its password. This would allow us to login with a password we set.

We could also change the group of our user in the /etc/passwd file to that of 0 (which is root).

![Group ID](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeTzXChpucirOOWHnNx%2F-MeU1xO0LPqm2MHI_lwp%2Fimage.png?alt=media\&token=70f63fdd-484b-44a6-af1a-10b40849ed65)

#### Escalation via SSH Keys

Use the commands in Payloads All the Things.

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Privilege%20Escalation.md#ssh-key>" %}

![SSH Private Key Discovered](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MeTzXChpucirOOWHnNx%2F-MeU82C0R2tpufIrE3KR%2Fimage.png?alt=media\&token=016f7591-60f2-4e1b-9b7b-0b1d75a5b6c3)

`find / -name authorized_keys 2> /dev/null`where public key is stored

`find / -name id_rsa 2> /dev/null`where private key is stored&#x20;

We can take the ssh private key and attempt to ssh to other machines in the network (make sure to make it executable on our attacking machine).

(On our kali machine), let us ssh to the same machine.

`ssh -i id_rsa root@192.168.4.67`

### Sudo

#### Escalation via Sudo Shell Escaping

Let's type in `sudo -l` to find out which commands we can run as root, and figure out how to abuse them to escalate our privileges.

![Commands that we can run as root](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-Mg9FZXxUlPwcGQLX89W%2F-Mg9HFJQb-hXTEX7NTE4%2Fimage.png?alt=media\&token=77a96b85-a2ae-4b06-8b3e-fc741a8560f2)

We will use the /usr/bin/vim command. Let us refer to GTFOBins below:

{% embed url="<https://gtfobins.github.io/>" %}

The sudo command looks interesting.

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-Mg9FZXxUlPwcGQLX89W%2F-Mg9IN0N4wJs87RtVfyL%2Fimage.png?alt=media\&token=529185fe-e3c1-4240-bc18-fffe7dcc957b)

Let's try it out.

![Success](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-Mg9FZXxUlPwcGQLX89W%2F-Mg9Ir0_7oZQXWvdDE9W%2Fimage.png?alt=media\&token=c6494ce7-eb6f-4aab-b9d7-faa67a470ebb)

We are now root.

Let us attempt using the `/usr/bin/awk` command.

![GTFOBins](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-Mg9FZXxUlPwcGQLX89W%2F-Mg9JaUoBthQzR0BFCZm%2Fimage.png?alt=media\&token=d966a92f-6a2c-45f7-b728-5a5e1f5464a8)

![Success](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-Mg9FZXxUlPwcGQLX89W%2F-Mg9Jr5wzbd4k88Xi7qM%2Fimage.png?alt=media\&token=7c0492fa-cb8c-4cab-b9dc-5f2e2bb39dac)

That one works as well.

#### Escalation via Intended Functionality

The `/usr/bin/apache2` command is not available in GTFOBins. However, a quick google search reveals we can view system files using it.

{% embed url="<https://touhidshaikh.com/blog/2018/04/11/abusing-sudo-linux-privilege-escalation/>" %}

![apache Command](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-Mg9FZXxUlPwcGQLX89W%2F-Mg9NKu6b8LBmaHp_1Rc%2Fimage.png?alt=media\&token=f2b73dc1-b6c1-4f66-ba75-b7568e359408)

Let us try it out

![Password Hash](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-Mg9FZXxUlPwcGQLX89W%2F-Mg9NDQsWMIKcy75pb6c%2Fimage.png?alt=media\&token=f48c6300-7c13-4251-891a-c9e5eeb94db3)

Sadly no shell. But we have managed to extract the root hash which we can attempt to crack offline.

The resource below highlights how you can use abuse the functionality of `wget` to read system files.

{% embed url="<https://veteransec.com/2018/09/29/hack-the-box-sunday-walkthrough/>" %}

Just because GTFOBins does not have a solution does not mean there aren't creative ways of abusing system functionality to escalate our privileges.

#### Escalation via LD\_PRELOAD

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-Mg9PGTjxbQCuEJArcNj%2F-Mg9PhxJpBt4jMqnZaQN%2Fimage.png?alt=media\&token=537a3828-5375-48d6-b7f7-73a6c3c9f00a)

Let us create a nano file named `shell.c` and type out some code.

![C Code](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-Mg9PGTjxbQCuEJArcNj%2F-Mg9RZVkjnoqZ5284d7N%2Fimage.png?alt=media\&token=cab5d34f-8f9e-4064-9722-39c781e1cc83)

Let us compile it and run it using any of the commands we can run as root.

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-Mg9PGTjxbQCuEJArcNj%2F-Mg9Sm6Uq3IZb71l-GIo%2Fimage.png?alt=media\&token=cf0bec48-9586-47a4-896a-2f31441bc65b)

We are now root.

### CVE-2019-14287

Find the exploit code below.

{% embed url="<https://www.exploit-db.com/exploits/47502>" %}

We will practice using a room in Try Hack Me known as Sudo Security Bypass.

{% embed url="<https://tryhackme.com/room/sudovulnsbypass>" %}

After using ssh to login to the server, we run `sudo -l` to find out which commands we can run as root.

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MgdgFEphzb4tmCxBCyo%2F-MgdiLixafiDYLbrDDfH%2Fimage.png?alt=media\&token=acb4e6f6-2448-4f0a-a92c-0128d6234722)

We **cannot** run bash as root.

Enter CVE-2019-14287 which affects sudo versions < 1.8.28. From the image below, we see that our sudo version is 1.8.21p2 so it is probably vulnerable to the exploit.

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MgdgFEphzb4tmCxBCyo%2F-MgdjZOd2G9SPB4FL2LE%2Fimage.png?alt=media\&token=0347136c-8df1-48df-839a-9a52ee099492)

Let us exploit it to escalate our privileges.

`sudo -u#-1 /bin/bash`

![We are root](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MgdgFEphzb4tmCxBCyo%2F-MgdjyScyIhx6AuU0lnl%2Fimage.png?alt=media\&token=5f609844-0bd5-4abb-9e23-86d2e51371a0)

And success! We are now root.

### CVE-2019-18634

Find below the exploit code. This vulnerability affects versions of sudo earlier than 1.8.26.

{% embed url="<https://github.com/saleemrashid/sudo-cve-2019-18634>" %}

We will use the "Sudo Buffer Overflow" room in Try Hack Me to practise this exploit.&#x20;

{% embed url="<https://tryhackme.com/room/sudovulnsbof>" %}

It is helpful in situations where we cannot run 'sudo'.

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MgdxhXF2SSUUyfsqSOL%2F-Mgdy7xkn5bAo7jgoDAY%2Fimage.png?alt=media\&token=f1f7bd26-34db-48e8-9405-a2fa6d648601)

After downloading the exploit code and compiling it, let us run it to escalate our privileges.

![CVE-2019-18634 ](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MgdkEuCDtS7YNmxpB5b%2F-MgdxYXYTBt6Yem4kIwh%2Fimage.png?alt=media\&token=fa4658e8-9050-4072-96dc-99746cade30a)

Success. We are now root.

### Set Owner User ID (SUID)

We can use the command below to find files with SUID.

`find / -perm -u=s -type f 2>/dev/null`

![Files with SUID](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MgiwoAla9wfUYQaCNlo%2F-MgjF8FtvgxKmCbQGwfJ%2Fimage.png?alt=media\&token=8fffa627-dadd-414e-9ffb-6e30393a2ec3)

We can see the SUID in the files e.g.

![SUID](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-Mi02yAXTMr0DW3P0HyV%2F-Mi094bjDFxdeIQYJDHt%2Fimage.png?alt=media\&token=dc720087-b5fe-45ab-be5e-f8831711e8b8)

We can then go to GTFOBins to search if there are any binaries we can use to bypass local security restrictions in misconfigured systems.

### Other SUID Escalation

#### Escalation via Shared Object Injection

We are looking for somewhere that we can inject.

`find / -type f -perm -04000 -ls 2>/dev/null`

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MiUuK8QconOf6SXkroS%2F-MiUwgTo2YxO_709Qptp%2Fimage.png?alt=media\&token=8726c11f-8507-4d19-ac5f-92eb94b49802)

![Something happens when we run the binary](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MiUuK8QconOf6SXkroS%2F-MiUxGJHu5Q62Hd435ec%2Fimage.png?alt=media\&token=1f263c59-eafe-4302-9ca1-53d554fcd574)

We will use a tool called strace to figure out what the binary is doing.

`strace /usr/local/bin/suid-so 2>&1`

`strace /usr/local/bin/suid-so 2>&1 | grep -i -E "open|access|no such file"`

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MiUuK8QconOf6SXkroS%2F-MiUysAjSU2LevKrGb4Z%2Fimage.png?alt=media\&token=0447862b-13b7-493e-bb7b-897921d2903b)

We will overwrite `libcalc.so` and put something malicious in it so that when the binary `suid-so` runs, we can elevate our privileges.

We have read-write access on /home/user.

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MiUuK8QconOf6SXkroS%2F-MiUzVuF3j3JgbL1c0u6%2Fimage.png?alt=media\&token=5f6e139a-e471-4998-9493-f0185c5e197c)

Let us create our malicious code, and save it us libcalc.c

![libcal.c](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MiUuK8QconOf6SXkroS%2F-MiV-qEv-xJGHL5d4Fwr%2Fimage.png?alt=media\&token=bbcd574f-d090-4fd0-9d07-6aede1acb657)

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MiUuK8QconOf6SXkroS%2F-MiV0kmfBA0ODcPZC01l%2Fimage.png?alt=media\&token=36f8304a-664e-45ff-9418-70cd0aa1fefd)

Now we just need to run `/usr/local/bin/suid-so`

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MiUuK8QconOf6SXkroS%2F-MiV1P7v7YDNH89CqQND%2Fimage.png?alt=media\&token=b2444b7c-4dd3-4393-bd8c-188581c5ab0e)

And we are root!!!

#### Escalation via Binary Symlinks

This is a vulnerability on nginx. It has to do with the permissions of the logs created by Nginx. Because of how the permissions are set, attackers can escalate their privileges from a www-data user to root.

The exploit can be found below:

{% embed url="<https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html>" %}

Linux Exploit Suggester indicates that the box is vulnerable.

For the exploit to work, the SUID bit has to be set on sudo.

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MiUuK8QconOf6SXkroS%2F-MiV45A87wBbrsAk-Bka%2Fimage.png?alt=media\&token=1177af9c-09ae-4284-af3f-0d10287d831d)

We will use a symlink to replace the log files with a malicious executable.

Once we execute the exploit, we get root.

![](https://3921415439-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MAg89Yj9y-c5VSLgwJh%2F-MiUuK8QconOf6SXkroS%2F-MiV77QXjYMfY__7GtHU%2Fimage.png?alt=media\&token=788b5d2e-d27a-4059-913a-0a98060338ee)

For more details and clarification, refer to TCM's video on academy.tcm-sec.com

#### Escalation via Environmental Variables

{% embed url="<https://academy.tcm-sec.com/courses/1154399/lectures/24800170>" %}

## Course Tips and Resources

* Linux Privilege Escalation Cheatsheet: <https://github.com/Ignitetechnologies/Linux-Privilege-Escalation?s=08>
* Linux-Privilege-Escalation-Resources: <https://github.com/TCM-Course-Resources/Linux-Privilege-Escalation-Resources>
* Basic Linux Privilege Escalation: <https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/>
* Linux Privilege Escalation: [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology and Resources/Linux - Privilege Escalation.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Privilege%20Escalation.md)
* Checklist - Linux Privilege Escalation: <https://book.hacktricks.xyz/linux-unix/linux-privilege-esanding> of escalation-checklist
* Sushant 747's Guide (Country dependent - may need VPN: <https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_-_linux.html>
* Windows / Linux Local Privilege Escalation Workshop: <https://github.com/sagishahar/lpeworkshop>
* Linux Privesc (Try Hack Me): <https://tryhackme.com/room/linuxprivesc>
* GTFOBins: <https://gtfobins.github.io/>
*
