From 023210d2b622220634f129235887f2d44c20e637 Mon Sep 17 00:00:00 2001 From: Eldar Marcussen Date: Fri, 6 Dec 2013 01:36:16 -0500 Subject: [PATCH 1/3] More examples of using the find command --- linux/find_files.md | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/linux/find_files.md b/linux/find_files.md index c7f152b..0f9a653 100644 --- a/linux/find_files.md +++ b/linux/find_files.md @@ -60,6 +60,38 @@ Commands that finds files on the file system are usually executed from within a /etc/issue /etc/issue.dpkg-dist +### Search by permissions + * **Command with arguments**: `find / -perm 777` + * **Description**: Locates files matching the permissions + * **Output**: + *
**Ubuntu:** Show/Hide
root@localhost:~/ find / -perm 777 + /initrd.img + /pentest/exploits/isr-evilgrade/include/sunjava/JavaPayload/FunnyClass2.jar + /pentest/exploits/isr-evilgrade/agent/java/javaws.exe + /pentest/exploits/isr-evilgrade/trash + /pentest/passwords/hashcat-gui/hashcat + /pentest/passwords/hashcat-gui/oclHashcat-plus + /pentest/passwords/hashcat-gui/oclHashcat-lite + /pentest/passwords/john/undrop + --snip-- +
+### Search by username + * **Command with arguments**: `find / -user root` + * **Description**: Locates files owned by the user "root" + * **Output**: + *
**Ubuntu:** Show/Hide
root@localhost:~/ find / -user root + / + /initrd.img + /pentest + /pentest/sniffers + /pentest/sniffers/dnschef + /pentest/sniffers/dnschef/dnschef.exe + /pentest/sniffers/dnschef/dnschef.ini + /pentest/sniffers/dnschef/dnslib + /pentest/sniffers/dnschef/dnslib/dns.py + /pentest/sniffers/dnschef/dnslib/__init__.py + --snip-- +
---- From 0f58a42c6df819b859e0ae1a6922393a987e05d2 Mon Sep 17 00:00:00 2001 From: Eldar Marcussen Date: Fri, 6 Dec 2013 01:45:17 -0500 Subject: [PATCH 2/3] Begining to document privilege escalation --- linux/privesc.md | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/linux/privesc.md b/linux/privesc.md index 1033b81..83f4b0f 100644 --- a/linux/privesc.md +++ b/linux/privesc.md @@ -1,3 +1,15 @@ -# Place Holder +# Sudo +Don't forget to check sudo to see if you can execute any commands with any privilege besides your user level +**Show which commands sudo allows you to run** +`sudo -l` -Content coming. Feel free to submit ;-) +# Find +The following commands are helpful when looking to exploit local applications for privilege escalation +**Finding world writeable directories** +`find / -perm 777` + +**Find setuid files** +`find / -perm +4000 -type f` + +**Find root setuid files** +`find / -perm +4000 -uid 0 -type f` From 153592fac421a57acfb0cbbc37f01b6d2783fe7d Mon Sep 17 00:00:00 2001 From: Eldar Marcussen Date: Sun, 8 Dec 2013 15:35:53 -0500 Subject: [PATCH 3/3] Added spaces for correct header parsing in GHMD --- linux/find_files.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/linux/find_files.md b/linux/find_files.md index 0f9a653..65d56a9 100644 --- a/linux/find_files.md +++ b/linux/find_files.md @@ -14,6 +14,7 @@ $(document).ready(function() { Commands that finds files on the file system are usually executed from within a shell (sh/bash) or through a forking function such as system() or exec(). ## ls + ### Attributes showing * **Command with arguments**: `ls -l [directory or filename]` * **Description**: Displays attributes of files and directories in the specified location @@ -51,6 +52,7 @@ Commands that finds files on the file system are usually executed from within a ---- ## find + ### Search by name * **Command with arguments**: `find /etc -name "issue*"` * **Description**: Locates files matching the name (wildcards supported) @@ -60,6 +62,7 @@ Commands that finds files on the file system are usually executed from within a /etc/issue /etc/issue.dpkg-dist + ### Search by permissions * **Command with arguments**: `find / -perm 777` * **Description**: Locates files matching the permissions @@ -75,6 +78,7 @@ Commands that finds files on the file system are usually executed from within a /pentest/passwords/john/undrop --snip-- + ### Search by username * **Command with arguments**: `find / -user root` * **Description**: Locates files owned by the user "root" @@ -96,6 +100,7 @@ Commands that finds files on the file system are usually executed from within a ---- ## locate + * **Command with arguments**: `locate ifconfig` * **Description**: Look files up in the location database * **Output**: