The Ethical Hacker Network - Privilege Escalation

Latest Additions

Who's Online

EH-Net > Ethical Hacking Discussions and Related Certifications > Network Pen Testing (Moderator: don) > Privilege Escalation

Pages: [1] Go Down

« previous next »

	Author	Topic: Privilege Escalation (Read 2655 times)
0 Members and 1 Guest are viewing this topic.

!TSS3cur3

Newbie

Offline

Posts: 3

Privilege Escalation

« on: June 13, 2012, 12:49:01 AM »

Hi Everyone,

Hope everyone is doing fine. I have a testing Linux box and I have an unprivileged user account (apache) and need to get root access. I tried every root exploit available and nothing works.

What's the best method of getting higher privileges.

Regards


	Logged

UNIX

Hero Member

Offline

Posts: 1235

Re: Privilege Escalation

« Reply #1 on: June 13, 2012, 02:55:09 AM »

Some generic advice:

Quote

Just downloading and running exploits won't do any good, you need to do a proper enumeration of your targets.

Some things to look for:

Check which OS in which version is running on which kernel version
Check the environment variables
Check running services, their version and under which user they are running
Check if any 3rd party applications are installed/running
Check config files, scripts, databases, logs etc. and look for credentials, misconfigurations etc.
Check if any jobs are scheduled
Check if you can sniff any further network traffic
...


	Logged

!TSS3cur3

Newbie

Offline

Posts: 3

Re: Privilege Escalation

« Reply #2 on: June 13, 2012, 08:43:27 AM »

Hi aweSEC,

I did check the OS, env, running services etc. But the problem is I'm checking all the stuff as a unprivileged user. Can't modify or change anything.

Just need someone to guide me a bit in the whole escalation process. What would one typically do if one has got an unprivileged shell.

Regards


	Logged

ziggy_567

Sr. Member

Offline

Posts: 361

Re: Privilege Escalation

« Reply #3 on: June 13, 2012, 09:14:12 AM »

I think what aweSEC might be trying to tell you is that its more common to find a misconfiguration that leads to privilege escalation than a local privilege escalation exploit from a site like exploit-db.com.