Weird PrivEsc Techniques | DarkCon 2021 Talk | #OSCP

A short talk I gave at DarkCon 2021 regarding 4 "weird" privilege escalation techniques, complete with explanations and demos.

1:10 - Bash Globbing (Cron Job Wildcards)
7:46 - Writable /etc/passwd
12:16 - Unquoted Service Path
17:57 - Windows GUI

[dropcake]

The wildcard priv esc one was very cool. It was featured in the THM room Skynet if I'm not mistaken. Great video Tib3rius.

[younesmohssen]

Woahhhh I’ve never seen the last windows privesc before! Suuuper coool. Never found it applied to a ctf box before but someone definitely should! This is like a gem this makes me so excited

[jprince]

When i jump into window as a linux user i couldn't even do anything because window is a noun variable

[haitham]

Hi there, great video! I have a question to the windows part: Who did you Setup the app to run as admin by running the shortcut to mspaint. The only way I found was to replace the shortcut command to: runas /savecred /user:.\admin mspaint
Then run it first time and provide password. After that creds are saved.
Any other way? How did you do that?

[JuanBotes]

thanks for the talk and your other content \o/

[jag]

I don't think you can ever encounter writable passwd files 🤔

[psychorockz]

I have a question regarding unquoted service paths execution. If the path was c:\Program Files\Some Directory Like This\Program.exe. How would the flow of execution be when it comes to c:\Program Files\Some Directory Like This?