Linux Privilege Escalation in Linux Part-2

ifconfig

This command provides details about network interfaces, such as IP addresses and subnet masks. Observing multiple interfaces could indicate the target system's connectivity to multiple networks, offering paths for lateral movement.

Example: Interfaces like eth0 for external connections, and tun0 or tun1 for internal connections, could suggest ways to explore internal networks.

ip route

This command displays the routing table, showing reachable network segments. Knowing these routes helps in assessing further network exploitation targets.

netstat

Gives insights into network connections, services, and listening ports. Knowing which services are open and connected can reveal exploitation opportunities.

• Useful Flags:
  • -a: Shows all connections and listening ports.
  • -tp: Displays connections with PID and program name.
  • -s: Shows network usage stats by protocol.

Importance: Discovering open, high-privilege services, especially those running as root, can aid privilege escalation.

find

The find command is essential for locating files based on criteria, useful for finding sensitive files or those with misconfigured permissions.

• File discovery:
  • find / -type f -perm 0777: Finds files with open read, write, and execute permissions.
  • find / -name 'flag1.txt': Locates a specific file, useful in CTFs.
• Permissions-based searches:
  • find / -perm -u=s -type f 2>/dev/null: Lists SUID files, which run with owner's privileges.
  • find / -writable -type d 2>/dev/null: Finds writable directories, potentially exploitable.

Finding Development Tools

Using find to locate interpreters or compilers (e.g., perl, python, gcc) can open new ways to escalate privileges by running custom scripts or compiling code on the target.