> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/sybaris/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/sybaris/priv-escalation.md).

# Priv Escalation

![](/files/HFSgvqyyg6gJ4aOj50sN)

### CVE 2021-4034 sudo version

{% embed url="<https://github.com/ly4k/PwnKit>" %}

Following the steps the github has I transferred the PwnKit binary to the machine and ran it, then I was able to get root.&#x20;

```
[pablo@sybaris tmp]$ chmod +x PwnKit
chmod +x PwnKit
[pablo@sybaris tmp]$ ./PwnKit 'id'
./PwnKit 'id'
uid=0(root) gid=0(root) groups=0(root),1000(pablo)
```

## Shared Object Hijacking&#x20;

The second Privilege Escalation is slightly harder. It requires us to exploit the utils.so shared object which is missing within the log-sweeper binary, which runs as root every minute.

![](https://miro.medium.com/max/1244/1*Mw7a4KB-psJTfY3r9q6PoQ.png)

Running log-sweeper we can see utils.so is missing.

![](https://miro.medium.com/max/1400/1*_PDCFOnP0iPeHgK2z5DxBA.png)

Since we have write access to /usr/local/lib/dev we can place our shared object there and since it is inside the LD\_LIBRARY\_PATH the system will try to find utils.so inside of /usr/local/lib/dev.

![](https://miro.medium.com/max/1046/1*VpwHriaLlUngI5xqjR6r_g.png)

creating the c file which we will compile into a Shared Object![](https://miro.medium.com/max/1024/1*mueO52KM2UpXdzPkG4qNww.png)

compiling the c file into a .so file

Great, now we have created a shared object which will give us a reverse shell as soon as executed and placed it in a path where the system will look for and execute it. Now i monitored the processes with pspy64 and waited for a minute or so, eventually the crontab runs and i get a root level shell.

![](https://miro.medium.com/max/1400/1*0S9UaGx57XjgyVWoDcLpHA.png)

monitoring the processes and seeing my reverse shell getting executed![](https://miro.medium.com/max/1054/1*GgXDnVRqnDdb0nXwT_gdpA.png)

r00t