Privilege Escalation Website

Privilege Escalation is a process of action for assault or exploit any damage or cracks, or flaws in a system or an operating system. in order to get access to central systems that are usually protected. Or type of network intrusion that takes advantage of programming errors or design flaws to give the attacker access to the network and related data and applications.

A. There are two types of privilege escalation: vertical and horizontal.
vertical privilege requires the attacker to give himself a higher right. This is usually accomplished by performing a kernel-level operations that allow an attacker to run unauthorized code.

Horizontal privilege requires the attacker to use the same privilege level he had been given, but assumes the identity of another user with the same permissions. For example, someone gained access to online banking accounts of others would be a horizontal privilege escalation

Example Privilege Escalation process to do:1. IG with nmap * suspicious look like port 10000 (webmin is sought)

2. SE done to determine the process that gap by nessus. here there is a high detected in the SSH and try to be exploitable






3. VA proceed with exploid: incoming apps - exploitable tool - open source - exploidb exploiddb-search (. / searchsploit webmin)    
* try (/ multiple/remote/2017.pl)




4. try running with pythonroot@bt:/pentest/exploits/exploitdb# python platforms/multiple/remote/2017.pl
  File "platforms/multiple/remote/2017.pl", line 20
    use LWP::Simple;
          ^
SyntaxError: invalid syntax


5. try one by one to enter and save search results to be open and accessible to the exploiddb example (/ multiple/remote/2017.pl)





6. see what is tercopy or any file 2017.pl




7. run file 2017.pl





8. Run file 2017.pl in ip and port website that attacked suspected earlier. use 0 as the website http. and the results will appear

9. Save the file from the results for the crack in the john with any name and any exstensi  * example nito.txt





10. open john
jond crack with the ripper -App-password-privilege escalation attack-attack-ofline jond the ripper

open file nito.txt dengan john