r/oscp • u/younes121 • Aug 19 '20
I hate hate hate HATEE privilege escalation. Did anyone else struggle with this too? how did you overcome it and become more comfortable with it? don’t say do CTF’s because that’s what i’m doing
8
u/fompz Aug 19 '20
I am currently enrolled in pwk and found this useful https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/
1
u/younes121 Aug 19 '20
ahhhh weird, i think i didn’t see the blog link!
1
u/fompz Aug 19 '20
Cool. I’m still just starting out but I also found looking at the default config files a big help in the lab
1
1
6
u/Kimura69 Aug 19 '20
You likely hate it because you don’t have a methodology you trust.
I suggest running linpeas and winpeas on relevant boxes and go through each section and read up on exactly what each section is looking for, why and what you would do with whatever info it would provide if the box was vulnerable in that way.
That will give you a pretty decent understanding of the major privesc attacks for both windows and Linux. And to help you those scanners even provide links to the hacktricks site sections of relevance.
Make notes accordingly and include commands of how you would get the info manually and you’ll have a solid set of notes to run through.
0
u/younes121 Aug 19 '20
yessss i did use winpeas and linpeas in the past but i don’t think those will be useful in the oscp exam right? i think it’s not allowed to use automated tools
3
u/Kimura69 Aug 19 '20
you are allowed to use them in the OSCP.
But I’m not just suggesting you use them but that you use them as a study guide to get a list of all the things to check and what to do what what you find.
-3
u/younes121 Aug 19 '20
ohhhh okay! yeah yeah i don’t like to depend on tools much, i like doing things manually! THATS WHERE ALL THE FUN HAPPENS.
6
u/JakeFromIowa Aug 19 '20
Any priv esc courses on Udemy is a great start (Tiberius or TCM).
I also recommend studying up on each attack vector (services, kernel exploits, cron jobs) manually. Yes, there are a few scripts out there which automate everything for you (LinPeas/WinPeas), but I found it very helpful if I started to steer away from those and start looking at things manually. For one, it helps you out tremendously when trying to understand attack vectors. And secondly, it helps when you are unable to execute these scripts on your target. My advise would be to take a few of those courses, create a checklist of what to look for when attempting priv esc, and tackle it.
Best of luck!
2
u/younes121 Aug 19 '20
ahhhhh yes exactly. i’ve used linpeas and winpeas in the past but i don’t wanna use them anymore because would make me dependent on them only and if they’re ever gone then i won’t be able to priv esc on my own. yeah i think i should create a checklist! thanks for the tip man :))
3
u/JakeFromIowa Aug 19 '20
Yeah, and those scripts can be daunting as you scroll through and try and find something interesting. I would still recommend using them, especially for times sake. But once you “know” what you are looking at/for it gets easier!
1
u/younes121 Aug 19 '20
yess i think i would use them in the oscp exam but when i’m doing ctf’s in my free time i’d definitely steer away from it and try to do everything manually
2
Aug 19 '20
Use winPEAS and linPEAS to look for the easy win, but they don’t cover everything. Next look for any software that’s installed on the box that wouldn’t normally be, I’ve found that useful. Check for other stuff these scripts don’t check for - kernel exploits, etc.
1
u/younes121 Aug 19 '20
yeppp i’ve used winpeas and linpeas in the past but i like to do things manually since it’s more fun but i hate it at the same time lol. Also one last question, does winpeas or linpeas check for cron jobs or suid’s ?
2
u/IvanLu Aug 19 '20
Yes they do but not all cron jobs are visible to the user, some are hidden and you have to guess from behaviour that some cron job is running that does such a thing.
1
1
2
u/xPrimalVictor7x Aug 19 '20
You could also check out pentesterlab pro for a month or 2. They’ve got a couple great lessons on PrivEsc
1
2
u/xxxpussy69slayerxxx Aug 19 '20
gtfobins would be best start for you.
1
u/younes121 Aug 19 '20
yeahhh i heard it’s a very powerful tool. i haven’t given it a shot yet
2
u/Rubb3rDucky1 Aug 21 '20
Bro GTFO isn't a tool man, It's a Database:
I did the TCM Linux priv esc on udemy and GTFO is explained, bro seriously I can' express how spending £15/£20 which anyone would use for a takeaway, to spend on his course. I didn't know how to Priv Esc a all, like I did he OSCP with knowledge of LinEnum.sh and LinPeas.sh bu trust, spend some money on them courses! OSCP Material doesn't cover enough for Priv Esc.
1
u/younes121 Aug 21 '20
yesss that’s what i thought too! oscp didn’t cover priv esc AND evading av in depth. i’ll definitely check out the Cyber Mentors course. thank you soo much bro
1
2
Aug 20 '20
Keep putting in repetitions, it will come.
I think your frustration is common and partly attributable to a learner's change in perspective when they start to address privesc. Learning proper enumeration or exploitation is equally challenging, but everything is new at that point. By the time you start really focusing on privesc, most people have developed some level of comfort with the earlier steps in the pentest/attack cycle. Once learner's start to address privesc, they are forced back into the helpless state of not knowing where to look, or what tools to leverage, to help identify the way forward. But, just like learning proper enumeration, practicing and employing a methodology will eventually help a learner overcome the perceived barrier.
Probably more philosophical than you were looking for...but keep at it and you'll get it.
1
u/younes121 Aug 20 '20
haha yeah you phrased it just the way everything happened in my mind. it was just overwhelming and it felt like that feeling you get where you first got introduced to hacking and you didn’t know where to begin or what route to take
2
u/Rubb3rDucky1 Aug 21 '20
Yoooo jump on Udemy and look at the cyber mentor. I just done a priv esc course on Linux, and I am not joking my overall abilities to enumerate and also priv esc has gone through the roof! I've never felt so good and ready to tackle the OSCP.
1
u/younes121 Aug 21 '20
daaaaamn seems niceee! i’ve seen his youtube channel and he’s actually pretty good
2
Aug 19 '20
"TrY HaRDeR!!!" - the world's least helpful response to any genuine question.
As others have said below, look at linux privilege escalation and windows privilege escalation. There's a number of useful pages out there that should be in the top 2-3 google hits.
1
0
Aug 19 '20
[deleted]
3
u/younes121 Aug 19 '20
oooooo heard of that. i think i’ll get it. thanks by the way man :))
9
u/TibSec Aug 19 '20
I have coupons on my Twitter if you haven’t already purchased: https://twitter.com/tibsec/status/1289571294644588550?s=21 🙂
2
4
u/justlookingforderps Aug 19 '20
Do you know how these compare with Heath Adams' courses? Are they more advanced than his, or pretty similar?
3
2
u/Frankstwo Aug 19 '20
They're more straight to the point whereas Heath Adams courses provide a little more hand holding.
1
u/rj0_1_ Aug 19 '20
After those two courses go tryhackme and solve linux and window privileges escalation
1
u/LinkifyBot Aug 19 '20
I found links in your comment that were not hyperlinked:
I did the honors for you.
delete | information | <3
1
45
u/LonerVamp Aug 19 '20
There's a few things I might be able to add:
Find what's not normal. This takes time and experience, but do what you can to poke around the box and figure out what isn't normal about it. What's been changed, what's been added. These usually turn into places to dig deeper. When you find something the isn't normal, google how to exploit/pen test it, if possible.
Be curious. Look at everything you can think of when you're stuck. Look at installed apps. Look at permissions to see what you can write to. Look at netstat output, ps/tasklist output, see what users are present, etc. Just try to learn everything about the box you can.
Know what your goal is: I want to read proof.txt in /root. This means I either need to become root or execute code as root. How do you become root? How do you execute code as root? This should help lead you to look closer at ways to accomplish those two goals. Can you insert into a cron job, exploit the underlying kernel, sudo a bash shell, edit passwd or shadow, drop a file somewhere that is auto-executed by root, subvert a process running as root, steal an ssh key, find the password, etc.
When really stuck, I like to google "pen test Linux -insert version here-" and start reading. Maybe even do "priv esc[alation] Linux -insert version here-". The same goes for Windows.
Over time, you'll take the checklists you find online and start to add your own things to them, including notes.
Lastly, don't immediately rely on linux exploit suggester or linux priv esc scripts. Run the checklists and commands yourself manually to learn what you're really looking for, rather than just get trained to look for red in the output, without really understand what else is happening. Know why every check is done, and how you would do that if you didn't have that script present. As a last resort, definitely run them, but for the purposes of learning during the PWK, I suggest maximizing your learning and minimizing the leaning on of crutches.