#Upload exploit suggester to local full
#Upload exploit suggester to local password
#Upload exploit suggester to local windows

#Upload exploit suggester to local full

Files and Folders with Full Control or Modify Access.

Any Vulnerable package installed or running.

#Upload exploit suggester to local windows

Privilege Escalation Vectorsįollowing information are considered as critical Information of Windows System: All this information helps the attacker to make the post exploit against the machine for getting the higher-privileged shell.

#Upload exploit suggester to local password

So, why not automate this task using scripts.īasically, privilege escalation is a phase that comes after the attacker has compromised the victim’s machine where he tries to gather critical information related to systems such as hidden password and weak configured services or applications and etc. Hence, doing this task manually is very difficult even when you know where to look. The number of files inside any Linux System is very overwhelming. So, in order to elevate privileges, we need to enumerate different files, directories, permissions, logs and /etc/passwd files. This shell is limited in the actions it can perform. When an attacker attacks a Linux Operating System most of the time they will get a base shell which can be converted into a TTY shell or meterpreter session.

I have always been interested in infosec but lately I’ve been reading a lot about topics like network security, penetration testing, reverse engineering with the objective that I’ll change careers to something more security-focused.In this article, we will shed light on some of the automated scripts that can be used to perform Post Exploitation and Enumeration after getting initial accesses on Linux based Devices. I’ve been working on this project for the past month trying to hack into a Linux box I’ve installed in a Vmware machine. The services that I got running are the following (with mysql only accessible from localhost): 22/tcp open ssh OpenSSH 4.3 (protocol 2.0)Ĩ0/tcp open http Apache httpd 2.2.3 ((CentOS)) I’ve chosen CentOS-5.0 and downloaded the image from this location: $ uname -r I’ve looked into Metasploitable and Damn Vulnerable Linux (but those were a bit artificial), so I’ve chosen an old Linux image (Centos) version with the hopes that it will be easy to exploit and a good playground for exercising my skills. So my imagined scenario is this: would it be possible to gain root privileges starting from a vulnerable web application? Let’s assume an attacker already managed to upload a script to the server. So I just uploaded a reverse php shell script (I used ). Uid=48(apache) gid=48(apache) groups=48(apache) context=system_u:system_r:httpd_t:s0 Now I start my listener and access the php script from the browser and I get this: nc -lvp 80 Didn’t work at first until I realized I have to change the listener on my host to port 80 or 443 because the firewall on the virtual machine prevented outbound traffic on most of the other ports. However, this shell is really limited as it runs as “apache” user and with selinux enabled, it’s crippled. I tried to see if there are any interesting processes, files, cron jobs and if there are any exploitable SUID binaries but of course this wasn’t the case since it’s mostly a clean install.