> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/solidstate/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/solidstate/priv-escalation.md).

# Priv Escalation

{% embed url="<https://www.hacknos.com/rbash-escape-rbash-restricted-shell-escape/>" %}

In order to escape Rbash I had to use the following ssh command.

```
ssh mindy@10.10.10.51 -t "bash --noprofile"
```

Once I transferred linpeas. The script identified numerous vectors.

1. PwnKit

Upon transfer of the PwnKit Binary, I was able to run the 32 version of the binary and get root access to the machine.

![](https://1969294183-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXeJGW7fniDYPpAiztsZC%2Fuploads%2FViDMp0NKsVbfIO1UH8Cx%2F2022-08-22_18-49.png?alt=media\&token=a6f38310-8aea-4738-9e28-d530262bfbd0)

ROOT!

1. ~~Other user: James~~

![](https://1969294183-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXeJGW7fniDYPpAiztsZC%2Fuploads%2FGGoH64pvYvD22O4MxS3C%2F2022-08-22_18-36.png?alt=media\&token=4f67d698-8455-4e9c-bd58-98eacd6bfec1)

![](https://1969294183-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXeJGW7fniDYPpAiztsZC%2Fuploads%2Fu1GwB3LI3pJ7QhyIGEhj%2F2022-08-22_18-38_1.png?alt=media\&token=3ca63ea8-135a-4182-bea7-7a43452ec077)

1. ~~Internal Server~~&#x20;

![](https://1969294183-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXeJGW7fniDYPpAiztsZC%2Fuploads%2FDwYZVulqTuKGGGIM0ygr%2F2022-08-22_18-34.png?alt=media\&token=3b82de01-3d94-40eb-9ae8-7b350d2a3556)

![](https://1969294183-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXeJGW7fniDYPpAiztsZC%2Fuploads%2FkHbtm9u2vuCikI55plbd%2F2022-08-22_18-56.png?alt=media\&token=170b1fef-9b29-4e34-a12a-098205a2a6fc)

~~4. SUID binaries~~

![](https://1969294183-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXeJGW7fniDYPpAiztsZC%2Fuploads%2FAChaCOmzIAPelBaJAX7n%2F2022-08-22_18-41.png?alt=media\&token=2f4ea15b-85b9-4c9b-97b3-132ee40e72f4)

#### Internal Processes&#x20;

According to PSpy&#x20;

There was a process that would run a couple times after being called as a cron job.

![](https://1969294183-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXeJGW7fniDYPpAiztsZC%2Fuploads%2FZZMzXj4I4Dcc7xnSybyF%2F2022-08-22_19-28.png?alt=media\&token=ecf4f2fe-a8a8-499f-b4e9-f556dda180db)

As we can see the commands running, we see that the cron job command runs then this tmp.py python scripts that chains the command below.&#x20;

This is important because this python script is actually running as root and thus we can manipulate it to get a reverse shell.&#x20;

![](https://1969294183-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXeJGW7fniDYPpAiztsZC%2Fuploads%2FSRdbl5gix81txWSAj8dc%2F2022-08-22_19-29_1.png?alt=media\&token=016274c0-1228-4d61-b620-cbbe020978d9)

I transferred my python reverse shell client to the machine which specified our attacker IP. I replaced the tmp.py with the command  cat.

```
cat client.py > /opt/tmp.py
```

Once I waited a couple of minutes I got a reverse shell on my listener.&#x20;

![](https://1969294183-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXeJGW7fniDYPpAiztsZC%2Fuploads%2FtJBCD9M5RcPDvx3mhBd8%2F2022-08-22_19-29.png?alt=media\&token=c625dbdd-33e7-4934-8965-36ca2f2a93ea)