From Foothold to Root
You have a shell. Now stabilize it, hunt from the inside, and take root.
What you will learn
- -Upgrade a raw shell into a usable interactive one
- -Run the local enumeration that surfaces privesc paths
- -Turn a misconfiguration into root and capture both flags
A foothold is a low-privilege user, not a win. This is the final phase of the loop: stabilize the you fought for, enumerate the box from the inside, and ride one misconfiguration up to .
Stabilize the shell first
The reverse shell you caught is raw. No tab completion, no arrow keys, and one stray Ctrl-C kills the whole session. Upgrade it to a proper TTY before you do anything else, or you will lose your foothold to a fat-finger.
$python3 -c 'import pty; pty.spawn("/bin/bash")'$export TERM=xtermAfter the PTY spawn, press Ctrl-Z to background the shell, run stty raw -echo; fg on your Kali box, then press Enter twice. Now you have arrow keys, tab
completion, and Ctrl-C stays inside the target instead of killing your session.
Enumerate again, from the inside
Escalation starts exactly like the whole engagement started: enumerate. You now see the box the way a local user does, which exposes surface no scan could. Check who you are, what you can run as root, and which files are misconfigured.
$id$sudo -l$find / -perm -4000 -type f 2>/dev/null$cat /home/*/user.txtRead the permission bits like a map
Half of Linux is spotting a file whose permissions are wrong for what it does. A SUID binary runs as its owner, not as you, so a SUID root program you can abuse is a direct path to root. Learn to read the mode string on sight.
chmod 755 file to set these bits.Turn the misconfiguration into root
Say sudo -l reports you may run find as root without a . find can
execute commands, so it hands you a root shell. This is the pattern for the
whole phase: a legitimate tool, running with privilege it should not lend you,
pointed at a shell.
$sudo find . -exec /bin/bash \; -quit$id$cat /root/root.txtWhen hands you a binary you can run as root, do not guess how to abuse it. Look it up on GTFOBins, which catalogs the exact one-liner that turns each common binary into a shell, a file read, or a write. Half of easy-box roots are a copy-paste from that site.
You just caught a raw reverse shell as a low-privilege user. What is the very first thing you do?
Which one command lists the programs your current user may run as root, and is the first privesc check to run?
It asks sudo to list your allowed commands rather than run one.