antonga23 antonga23

## FullExample.php
<?php
require_once("PHPExcel/PHPExcel.php");
$phpExcel = new PHPExcel();

$styleArray = array(
	'font' => array(
		'bold' => true,
	)
);

## corrupt_zsh.sh
cd ~
mv .zsh_history .zsh_history_bad
strings -eS .zsh_history_bad > .zsh_history
fc -R .zsh_history

## Privilege Escalation.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                antonga23
                / Privilege Escalation.md
            
            
              Created
              May 7, 2021 14:52
                — forked from A1vinSmith/Privilege Escalation.md
            
              
                Privilege Escalation: Systemctl (Misconfigured Permissions — sudo/SUID) 
              
          
    For better reading experience

https://alvinsmith.gitbook.io/progressive-oscp/untitled/vulnversity-privilege-escalation
0. Prepare your payload root.service

[Unit]
Description=roooooooooot

[Service]
Type=simple


## db_connect_test.php
<?php
$active_group = 'default';
$query_builder = TRUE;

$db['default'] = array(
    'dsn'          => '',
    'hostname'     => '127.0.0.1', // better than localhost if mysqli.default_socket points to a unknown path
    'username'     => 'db_user', // As of MySQL v5.7, you can't use 'root' without sudo - you must use a different username and password - https://askubuntu.com/questions/763336/cannot-enter-phpmyadmin-as-root-mysql-5-7
    'password'     => 'password',
    'database'     => 'dbname',

## json_create.py
def write_json():
  result = {} #some random json
  with open('data.json', 'w', encoding='utf-8') as f:
      json.dump(result, f, ensure_ascii=False, indent=4)

## dig.py
def dig(tree, path):
    for key in path.split("."):
        if isinstance(tree, dict) and tree.get(key):
            tree = tree[key]
        else:
            return None
    return tree

  #EXAMPLE
#   mydict = {

## seleniumZoomChange.py
    driver.get('chrome://settings/')
    driver.execute_script('chrome.settingsPrivate.setDefaultZoom(zoomValue);')

## remove all docker containers
docker rm -f $(docker ps -a -q)

## es_masternode.sh
#!/usr/bin/env bash

docker run --rm --ulimit nofile=65536:65536 --name esn01 -p 9200:9200 -v esdata01:/usr/share/elasticsearch/data --network elastic-network -e "node.name=esn01" -e "cluster.name=es-cluster" -e "cluster.initial_master_nodes=esn01" -e "bootstrap.memory_lock=true" --ulimit memlock=-1:-1 -e ES_JAVA_OPTS="-Xms2g -Xmx2g" docker.elastic.co/elasticsearch/elasticsearch:7.3.0


# Create the master node for our cluster
# NB we increase max file descriptors to 65536 using the nofile argument

# Expected Output should be similar to this

## forwardport.sh
sudo iptables -t nat -L
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8000
	<?php
	require_once("PHPExcel/PHPExcel.php");
	$phpExcel = new PHPExcel();

	$styleArray = array(
	'font' => array(
	'bold' => true,
	)
	);
	cd ~
	mv .zsh_history .zsh_history_bad
	strings -eS .zsh_history_bad > .zsh_history
	fc -R .zsh_history
	<?php
	$active_group = 'default';
	$query_builder = TRUE;

	$db['default'] = array(
	'dsn' => '',
	'hostname' => '127.0.0.1', // better than localhost if mysqli.default_socket points to a unknown path
	'username' => 'db_user', // As of MySQL v5.7, you can't use 'root' without sudo - you must use a different username and password - https://askubuntu.com/questions/763336/cannot-enter-phpmyadmin-as-root-mysql-5-7
	'password' => 'password',
	'database' => 'dbname',
	def write_json():
	result = {} #some random json
	with open('data.json', 'w', encoding='utf-8') as f:
	json.dump(result, f, ensure_ascii=False, indent=4)
	def dig(tree, path):
	for key in path.split("."):
	if isinstance(tree, dict) and tree.get(key):
	tree = tree[key]
	else:
	return None
	return tree

	#EXAMPLE
	# mydict = {
	driver.get('chrome://settings/')
	driver.execute_script('chrome.settingsPrivate.setDefaultZoom(zoomValue);')
	#!/usr/bin/env bash

	docker run --rm --ulimit nofile=65536:65536 --name esn01 -p 9200:9200 -v esdata01:/usr/share/elasticsearch/data --network elastic-network -e "node.name=esn01" -e "cluster.name=es-cluster" -e "cluster.initial_master_nodes=esn01" -e "bootstrap.memory_lock=true" --ulimit memlock=-1:-1 -e ES_JAVA_OPTS="-Xms2g -Xmx2g" docker.elastic.co/elasticsearch/elasticsearch:7.3.0


	# Create the master node for our cluster
	# NB we increase max file descriptors to 65536 using the nofile argument

	# Expected Output should be similar to this
	sudo iptables -t nat -L
	sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8000