Penetration Testing

Privilege Escalation

2 sections18 commands

Linux Privilege Escalation

9 entries
  • sudo -lCheck sudo permissions
  • find / -perm -4000 2>/dev/nullFind SUID binaries
  • find / -writable -type d 2>/dev/nullFind writable directories
  • cat /etc/crontabCheck cron jobs
  • ls -la /etc/passwd /etc/shadowCheck file permissions
  • uname -aKernel version (check exploits)
  • cat /proc/versionKernel and compiler info
  • getcap -r / 2>/dev/nullFind files with capabilities
  • envCheck environment variables

Windows Privilege Escalation

9 entries
  • whoami /privCheck user privileges
  • whoami /groupsCheck group memberships
  • systeminfoSystem information
  • net userList users
  • net localgroup administratorsList admin group
  • cmdkey /listStored credentials
  • reg query HKLM /f password /t REG_SZ /sSearch registry for passwords
  • schtasks /query /fo LIST /vList scheduled tasks
  • icacls <file>Check file permissions
Back to cheat sheets