Privilege Escalation and Post Exploitation

• Windows Privilege Escalation Fundamentals
  From <http://www.fuzzysecurity.com/tutorials/16.html>
•  Basic Linux Privilege Escalation
  
  
  From <https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/>
  
  
  
  Linuxprivchcker needs python on the system which usually is there. If not, one could do the similar thing using bash. Will have to serach in gethub site
  
  
  python -c 'import pty; pty.spawn("/bin/sh")'
  
  
  ……emulate bash session from an hacked session so one can enter root pwd. If you try w/o it, you may get a message "su: must be run from a terminal"
  From <https://netsec.ws/?p=337>
•  Linux Post Exploitation Command List
  
  
  
  From <https://github.com/mubix/post-exploitation/wiki/Linux-Post-Exploitation-Command-List>
•  Escaping Restricted Linux Shells
  
  
  
  From <https://pen-testing.sans.org/blog/2012/06/06/escaping-restricted-linux-shells> 
• Offensive Security’s Exploit Database Archive
  
  
  
  From <https://www.exploit-db.com/>
• Escaping restricted shell : 
  
  
  If I can run the command echo, I can easily “escape” and bypass the limited shell by using the command echo os.system('/bin/bash')
• Password cracker Last 50 successful MD5 decryptions / founds 
• 
  From <https://hashkiller.co.uk/> 
• 3. The following python script appeared to create the above string in cryptedpass.txt: /encode & decode pwd
  sh-4.1$ cat cryptpass.py
  cat cryptpass.py
  #Enhanced with thanks to Dinesh Singh Sikawar @LinkedIn
  import base64,codecs,sys
  def encodeString(str):
      base64string= base64.b64encode(str)
      return codecs.encode(base64string[::-1], 'rot13')
  cryptoResult=encodeString(sys.argv[1])
  print cryptoResult
  The above script was modified on the attacking machine to decode the string:
  #Enhanced with thanks to Dinesh Singh Sikawar @LinkedIn
  import base64,codecs,sys
  def encodeString(str):
      base64string= base64.b64encode(str)
      return codecs.encode(base64string[::-1], 'rot13')
  def decodeString(str):
      string = str[::-1]
      string = string.encode("rot13")
      return base64.b64decode(string)
  print decodeString(sys.argv[1])
  String successfully decoded:
  [root:~]# python reverse.py "=RFn0AKnlMHMPIzpyuTI0ITG"
  LetThereBeFristi!
  
  
  
  From <https://highon.coffee/blog/fristileaks-walkthrough/>