> For the complete documentation index, see [llms.txt](https://ivalexev.gitbook.io/rednote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ivalexev.gitbook.io/rednote/pentesting-process/privilege-escalation/linux.md).

# Linux

## Enumeration

<table><thead><tr><th width="172">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS">LinPEAS</a></td><td><a href="https://github.com/peass-ng/PEASS-ng/releases">DOWNLOAD</a>.<br>In <a href="https://github.com/peass-ng/PEASS-ng/tree/master/metasploit">Metasploit</a>.</td></tr><tr><td><a href="https://github.com/rebootuser/LinEnum">LinEnum</a></td><td><code>./LinEnum.sh -e &#x3C;OUTPUT_FILE></code></td></tr><tr><td><a href="https://github.com/CISOfy/lynis">Lynis</a></td><td>Security auditing tool for Linux, macOS and UNIX-based systems. Test security defenses.<br><code>./lynis audit system</code></td></tr></tbody></table>

## Functionality

[GTFOBins](https://gtfobins.github.io/) shows how to exploit SUID, Capabilities, and SUDO vulnerabilities on known programs.

{% embed url="<https://gtfobins.github.io/>" %}

### SUDO

The sudo utility (Superuser-Do) can be used to run a command with elevated privileges.\
Must be a member of the sudo group.

{% code overflow="wrap" %}

```bash
sudo -V   # if vulnerable version
```

{% endcode %}

{% code overflow="wrap" %}

```bash
sudo -l
```

{% endcode %}

See `NOPASSWD` entries.\
Also remember **abuse of relative paths** and **Wildcard**.

{% code overflow="wrap" %}

```bash
chmod u+s /bin/bash
/bin/bash -p
```

{% endcode %}

### SUID Program

Programs with the SUID flag will run with owner privileges.\
Analyze these programs.

{% code overflow="wrap" %}

```bash
find / -perm -u=s -type f 2>/dev/null
```

{% endcode %}

{% code overflow="wrap" %}

```bash
find / -user root -perm -4000 -exec ls -ldb {} \; 2>/dev/null
```

{% endcode %}

### SGID Program

Programs with the SGID flag run binaries as if we were part of the group that created them.\
Analyze these programs.

{% code overflow="wrap" %}

```bash
find / -perm -g=s -type f 2>/dev/null
```

{% endcode %}

{% code overflow="wrap" %}

```bash
find / -user root -perm -6000 -exec ls -ldb {} \; 2>/dev/null
```

{% endcode %}

### Capabilities

Capabilities are additional attributes that can be applied to processes, binaries, and services to assign specific privileges (ex., administrative).\
Analyze the presence of misconfigurations.

{% code overflow="wrap" %}

```bash
/usr/sbin/getcap -r / 2>/dev/null
```

{% endcode %}

{% code overflow="wrap" %}

```bash
find /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -type f -exec getcap {} \;
```

{% endcode %}

### Groups

If the user is part of some privileged groups then he can perform privileged and particularly harmful actions.

{% code overflow="wrap" %}

```bash
id # see groups
```

{% endcode %}

* [Docker](/rednote/pentesting-process/privilege-escalation/linux/linux-privilege-escalation-with-groups.md#docker)
* [LXD / LXC](/rednote/pentesting-process/privilege-escalation/linux/linux-privilege-escalation-with-groups.md#lxd-lxc)
* [disk](/rednote/pentesting-process/privilege-escalation/linux/linux-privilege-escalation-with-groups.md#disk)
* [adm](/rednote/pentesting-process/privilege-escalation/linux/linux-privilege-escalation-with-groups.md#adm)

### Programms

See versions of various executable programs to check for Privilege Escalation exploits.\
See [CVE](/rednote/pentesting-process/cve/linux.md) section.

## Process

```bash
watch -n 1 "ps -aux | grep pass"
```

### Cron Jobs

Look through the Cron Jobs if they are called editable files to be exploited.

{% code overflow="wrap" %}

```bash
ls -lah /etc/cron* 
```

{% endcode %}

{% code overflow="wrap" %}

```bash
crontab -l
```

{% endcode %}

{% code overflow="wrap" %}

```bash
grep "CRON" /var/log/syslog
cat /var/log/cron.log
```

{% endcode %}

Also remember abuse via Wildcard.

### [pspy](https://github.com/DominicBreuker/pspy)

Command-line tool designed to snoop around linux processes without needing root permissions. It allows you to see commands executed by other users, cron jobs, etc. while they are running.

{% code overflow="wrap" %}

```bash
./pspy32  
./pspy32s # short version
```

{% endcode %}

{% code overflow="wrap" %}

```bash
./pspy64  
./pspy64s # short version
```

{% endcode %}

## File

### Documents

Search for sensitive information in different files, such as system password files, files in the home profile, text files saved on Desktop/Documents, temporary files, etc.

{% code overflow="wrap" %}

```bash
# See if readable and writable
/etc/passwd
/etc/shadow
/etc/security/opasswd
/etc/sudoers 
```

{% endcode %}

**Note**:\
In `/etc/passwd` and `/etc/shadow` you can remove the `x` and insert instead the output of: `openssl passwd <PASS>`.\
Or you can add `<USER> ALL=(ALL:ALL) ALL` | `<USER> ALL=(ALL) NOPASSWD: ALL` in `/etc/sudoers`.

{% code overflow="wrap" %}

```bash
cat ~/.bashrc
cat ~/.bash_profile
```

{% endcode %}

{% code overflow="wrap" %}

```bash
ls /tmp
ls /var/tmp
ls /dev/shm
```

{% endcode %}

### SSH keys

Look for ssh keys which may also be located elsewhere in the file system.

{% code overflow="wrap" %}

```bash
ls ~/.ssh
# check known_hosts to find out key targets
```

{% endcode %}

{% code overflow="wrap" %}

```bash
grep -rnw "PRIVATE KEY" /* 2>/dev/null | grep ":1"
```

{% endcode %}

{% code overflow="wrap" %}

```bash
grep -rnw "ssh-rsa" /* 2>/dev/null | grep ":1"
```

{% endcode %}

### Config

Search for sensitive information in configuration files.

{% code overflow="wrap" %}

```bash
for l in $(echo ".conf .config .cnf");do echo -e "\n-->" $l; find / -name *$l 2>/dev/null | grep -v "lib\|fonts\|share\|core" ; done
```

{% endcode %}

{% code overflow="wrap" %}

```bash
find / ! -path "*/proc/*" -iname "*config*" -type f 2>/dev/null | grep -v "lib\|fonts\|share\|core
```

{% endcode %}

### Backup

Check if there are any backup files that may contain sensitive information.

{% code overflow="wrap" %}

```bash
find / -name ‘*.bak’ 2>/dev/null
```

{% endcode %}

### Script

Also check the bash scripts.

{% code overflow="wrap" %}

```bash
find / -name *.sh 2>/dev/null | grep -v "doc\|lib\|headers\|share\|src\|snap";
```

{% endcode %}

### Writable Files and Directories

Check if there are any interesting writable files and folders.

{% code overflow="wrap" %}

```bash
find / -path /proc -prune -o -type [f/d] -perm -o+w 2>/dev/null
```

{% endcode %}

{% code overflow="wrap" %}

```bash
find / -writable -type [f/d] 2>/dev/null
```

{% endcode %}

### Hidden Files and Directories

Check if there are any interesting hidden files and folders with sensitive information.

{% code overflow="wrap" %}

```bash
find / -type f -name ".*" -exec ls -l {} \; 2>/dev/null | grep <USER>
```

{% endcode %}

{% code overflow="wrap" %}

```bash
find / -type d -name ".*" -ls 2>/dev/null
```

{% endcode %}

## Password

<table><thead><tr><th width="196">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://github.com/AlessandroZ/LaZagne">LaZagne</a></td><td>It searches for passwords.<br><code>laZagne.py all</code></td></tr><tr><td><a href="https://github.com/huntergregal/mimipenguin">mimipenguin</a></td><td>A tool to download the current Linux user's login password.</td></tr></tbody></table>

### Browser

<table><thead><tr><th width="196">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://github.com/moonD4rk/HackBrowserData">HackBrowserData</a></td><td>Extract sensitive data, including passwords, from browsers.<br><code>./hack-browser-data[.exe]</code> <em>(check the <code>results</code> directory)</em></td></tr></tbody></table>

## Various

### History

Search the command history.

{% code overflow="wrap" %}

```bash
cat ~/.*history
```

{% endcode %}

{% code overflow="wrap" %}

```bash
history
```

{% endcode %}

{% code overflow="wrap" %}

```bash
find / -type f \( -name *_hist -o -name *_history \) -exec ls -l {} \; 2>/dev/null
```

{% endcode %}

### Variables

Check environment variables for sensitive information such as passwords or misconfiguration.

{% code overflow="wrap" %}

```bash
env
```

{% endcode %}

{% code overflow="wrap" %}

```bash
echo $PATH
```

{% endcode %}

### Library

For ELFs see if you can manipulate the LD\_PRELOAD variable or the RUNPATH setting of the binaries. In Python see if you can manipulate the PYTHONPATH variable or if there are writable directories in the module import.

* [LD\_PRELOAD](/rednote/pentesting-process/privilege-escalation/linux/linux-privilege-escalation-with-library.md#ld_preload)
* [RUNPATH](/rednote/pentesting-process/privilege-escalation/linux/linux-privilege-escalation-with-library.md#runpath)
* [PYTHONPATH](/rednote/pentesting-process/privilege-escalation/linux/linux-privilege-escalation-with-library.md#pythonpath)

### Passive Traffic

```bash
# sudo on tcpdump
sudo tcpdump -i lo -A | grep "pass"
```

<table><thead><tr><th width="137">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://github.com/lgandx/PCredz">PCredz</a></td><td>Capture sensitive information from live network traffic, with tcpdump</td></tr></tbody></table>

### Restricted Shells

Certain users may be assigned shells with limited functionality, such as rbash, rksh, rzsh

Check executable commands and look for them in [GTFOBins](https://gtfobins.github.io/)

{% code overflow="wrap" %}

```bash
compgen -c
```

{% endcode %}

Also try

* Command injection with `` ` ``
* Command Chaining with `;` `&` `|`
* Variable changes (`export -p`)
* Shell functions

After the escape, you may need to update the path variable.

{% code overflow="wrap" %}

```
export PATH=$PATH:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
```

{% endcode %}

### Container

Check if we are in a container

{% code overflow="wrap" %}

```bash
cat /proc/mounts 
# if there is a docker and if there are mounts with sensitive content 
```

{% endcode %}

Containers can be run as privileged or non-privileged.

{% code overflow="wrap" %}

```bash
cat /proc/1/status | grep Cap
# CapPrm , CapEff e CapBnd
```

{% endcode %}

Decode with capsh

{% code overflow="wrap" %}

```bash
capsh --decode=<VALUE>
```

{% endcode %}

In order to exploit these capabilities, we would first have to find a privilege escalation to root in the container, then exploit a privilege container escape.

## Kernel

Exploit Kernel Level.\
Depends on Kernel Version and Operating System.\
Better to compile the exploit on the target if it has gcc.\
**May cause crashes!**

<table><thead><tr><th width="151">Tool</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://github.com/The-Z-Labs/linux-exploit-suggester">Linux-Exploit-Suggester</a></td><td>It allows you to detect kernel-level security weaknesses.</td></tr></tbody></table>

See [Linux-CVE](/rednote/pentesting-process/cve/linux.md) section.