https://lukaszpastuszak.dev/tags/privilege-escalation/Recent content in Privilege-Escalation on Łukasz Pastuszak - security notesHugoen-usSun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/altered/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/altered/Offensive MySQL techniques studied on Altered: enumeration, file read/write, UDF-based RCE, general_log webshells, hash harvesting and persistence.https://lukaszpastuszak.dev/writeups/enterprise/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/enterprise/SQL injection in a custom WordPress plugin leads to credentials in a draft post, a Joomla admin file upload lands a shell on the host, and a SUID stack buffer overflow in /bin/lcars gives root.https://lukaszpastuszak.dev/writeups/forge/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/forge/An 'upload from URL' feature is an SSRF read primitive; a redirect from the attacker's server bypasses the loopback blacklist and reaches an internal FTP for the SSH key, and pdb.post_mortem in a sudo script gives root.https://lukaszpastuszak.dev/writeups/goodgames/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/goodgames/Union-based SQL injection dumps an MD5 admin hash, password reuse reaches an internal Flask panel, SSTI gives RCE in a container, and a shared bind-mount plus a SUID bit escapes to root on the host.https://lukaszpastuszak.dev/writeups/media/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/media/A WMP playlist file leaks Net-NTLMv2 for a crack and SSH login, an NTFS junction redirects an Apache write into the web root for a webshell, and FullPowers plus GodPotato reach SYSTEM.https://lukaszpastuszak.dev/writeups/node/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/node/A leaky Express API exposes hashes and a hidden admin, a password-protected backup yields MongoDB credentials reused for SSH, a Mongo-driven scheduler runs exec() as another user, and a SUID binary falls to a ret2libc buffer overflow (plus several unintended blacklist bypasses).https://lukaszpastuszak.dev/writeups/permx/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/permx/An unauthenticated file upload in Chamilo LMS (CVE-2023-4220) gives RCE as www-data, a reused database password reaches mtz, and a symlink-following sudo ACL script escalates to root.https://lukaszpastuszak.dev/writeups/pollution/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/pollution/A leaked Burp export gives an admin token and XXE, Redis session tampering reaches a developers portal, an LFI PHP filter chain lands RCE, FastCGI pivots to victor, and prototype pollution in a Node.js API run as root gives a root shell.https://lukaszpastuszak.dev/writeups/postman/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/postman/An unauthenticated Redis instance gives an RDB write primitive for an SSH key, an encrypted id_rsa.bak cracks to a reused password for Matt, and Webmin 1.910 (CVE-2019-12840) command injection gives root.https://lukaszpastuszak.dev/writeups/redcross/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/redcross/Shared PHP sessions between subdomains, an NSS + PostgreSQL account backend, command injection in a setuid wrapper, and a x64 ROP buffer overflow, with multiple paths at every stage.https://lukaszpastuszak.dev/writeups/redpanda/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/redpanda/SpEL SSTI in a Spring Boot search box gives a shell as woodenk, a hardcoded password reused for SSH, and a root cron job chaining log poisoning, path traversal, EXIF metadata path injection and XXE leaks the root SSH key.https://lukaszpastuszak.dev/writeups/sniper/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/sniper/LFI in a language parameter plus PHP session poisoning gives RCE as IUSR, a leaked database password reused via PSCredential reaches chris, and a malicious CHM captures the administrator's Net-NTLMv2 for SYSTEM.https://lukaszpastuszak.dev/writeups/timing/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/timing/A login timing side channel enumerates users, mass assignment sets role=1, an LFI plus php://filter discloses source, a predictable MD5(time()) upload name gives RCE, a git history leak yields a reused password, and Axel's .axelrc default_filename overwrites root's authorized_keys.https://lukaszpastuszak.dev/writeups/tombwatcher/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/tombwatcher/A chain of Active Directory ACL abuses (WriteSPN, AddSelf, ReadGMSAPassword, ForceChangePassword, WriteOwner) reaches john, then AD Recycle Bin plus ADCS ESC15 (CVE-2024-49019) escalates to Administrator.https://lukaszpastuszak.dev/writeups/vulncicada/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/vulncicada/A password on a sticky note in an image from an open NFS share, Kerberos-only authentication, ADCS ESC8 exploited via a Kerberos relay (a serialized empty CREDENTIAL_TARGET_INFORMATION DNS record) plus PetitPotam coercion, a DC machine-account certificate, DCSync, and the Administrator hash.