🛗Linux PrivEsc
Practice your Linux Privilege Escalation skills on an intentionally misconfigured Debian VM with multiple ways to get root! SSH is available. Credentials: user:password321
Room Attributes
Value
Task 1 Deploy the Vulnerable Debian VM
Deploy the machine and login to the "user" account using SSH.
Run the "id" command. What is the result?
Task 2 Service Exploits
Read and follow along with the above.
Task 3 Weak File Permissions - Readable /etc/shadow
What is the root user's password hash?
What hashing algorithm was used to produce the root user's password hash?
What is the root user's password?
Task 4 Weak File Permissions - Writable /etc/shadow
Read and follow along with the above.
Task 5 Weak File Permissions - Writable /etc/passwd
Run the "id" command as the newroot user. What is the result?
Task 6 Sudo - Shell Escape Sequences
How many programs is "user" allowed to run via sudo?
One program on the list doesn't have a shell escape sequence on GTFOBins. Which is it?
Consider how you might use this program with sudo to gain root privileges without a shell escape sequence.
Task 7 Sudo - Environment Variables
Read and follow along with the above.
Task 8 Cron Jobs - File Permissions
Read and follow along with the above.
Task 9 Cron Jobs - PATH Environment Variable
What is the value of the PATH variable in /etc/crontab?
Task 10 Cron Jobs - Wildcards
Read and follow along with the above.
Task 11 SUID / SGID Executables - Known Exploits
Read and follow along with the above.
Task 12 SUID / SGID Executables - Shared Object Injection
Read and follow along with the above.
Task 13 SUID / SGID Executables - Environment Variables
Read and follow along with the above.
Task 14 SUID / SGID Executables - Abusing Shell Features (#1)
Read and follow along with the above.
Task 15 SUID / SGID Executables - Abusing Shell Features (#2)
Read and follow along with the above.
Task 16 Passwords & Keys - History Files
What is the full mysql command the user executed?
Task 17 Passwords & Keys - Config Files
What file did you find the root user's credentials in?
Task 18 Passwords & Keys - SSH Keys
Read and follow along with the above.
Task 19 NFS
What is the name of the option that disables root squashing?
Task 20 Kernel Exploits
Read and follow along with the above.
Task 21 Privilege Escalation Scripts
Experiment with all three tools, running them with different options. Do all of them identify the techniques used in this room?
Last updated