Priv Esc

find / -type f -perm -04000 -ls 2>/dev/null
www-data@solstice:/dev/shm$ cat /var/log/apache2/access.log.1
cat /var/log/apache2/access.log.1
www-data@solstice:/dev/shm$ echo test > /var/log/apache2/access.log.1
echo test > /var/log/apache2/access.log.1
www-data@solstice:/dev/shm$ ^[[A^[[A
echo test > /var/log/apache2cat.1
test
www-data@solstice:/dev/shm$

Had to revert the machine but the jist is to get RCE on the first access log and then use it to add php code into the root owned one then pop a shell

PreviousEnumerationNextPriv Esc

Last updated