whx
/
killchain-compendium
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

added information

This commit is contained in:
Stefan Friese 2023-08-18 23:05:23 +02:00
parent 2c7e23d8ed
commit 742e33b85b
2 changed files with 23 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
Post Exploitation/NFS Root Squash.md
View File

@ -1,13 +1,28 @@
# NFS NO ROOT SQUASH # NFS NO ROOT SQUASH
* Mount nfs locally and gain root Mount NFS locally and gain root through activated `no_root_squash`.
When "no_root_squash" is enabled on an NFS share, it means that the "root" user
from the client system retains its full privileges when interacting with files
on the NFS share. In other words, any actions performed by the "root" user on
the client system are replicated with full permissions on the NFS server. This
can potentially lead to a security vulnerability, especially if the client
system is compromised or maliciously manipulated.
## Exploit
### Craft a Shell
Craft a shell and execute it on the NFS share which has `no_root_squash`
enabled to gain root privilege.
## Craft a Shell
```sh ```sh
msfvenom -p linux/x86/exec CMD="/bin/bash -p" -f elf -o /tmp/nfs/shell.elf msfvenom -p linux/x86/exec CMD="/bin/bash -p" -f elf -o /tmp/nfs/shell.elf
``` ```
* Copy to target and use it
After the shell has been created on or copied to the share, execute it on the
target share
```sh ```sh
./shell.elf -p ./shell.elf -p
``` ```

8
Post Exploitation/pspy.md
View File

@ -1,5 +1,7 @@
# pspy # pspy
* Snoop processes withou root permissions [pspy](https://github.com/DominicBreuker/pspy.git) is a linux command-line utility that allows you to observe processes without
* [Repo](https://github.com/DominicBreuker/pspy.git) being detected. It is used for monitoring and analyzing system activities. pspy
allows you to track running processes, their arguments, and related
information, which can be useful for debugging, security auditing, and system
analysis.