Horizontal escalation

You have already learned how to spawn a TTY shell and perform enumeration. In this recipe, we will look at some of the methods where horizontal escalation can be done to gain more privileges on the system.

How to do it...

Here, we have a situation where we have got a reverse shell as www-data.

Running sudo –-list, we find that the user is allowed to open a configuration file as another user, waldo:

So, we open up the config file in VI Editor, and to get a shell in VI, we type this in the VI’s command line:

!bash

We now have a shell with the user waldo. So, our escalation was successful.

Note

In some cases, we may also find authorized keys in the ssh directory or saved passwords, that help us perform horizontal escalation.