snap_priv_esc

snapprivesc 通过 snapd 实现 Linux 权限提升的另一种利用方法 CVE-2019-7304 什么是 snap？ Snap 是 Canonical 为使用 Linux 内核的 操作系统 开发的软件 打包 和 部署 系统。这些包被称为 snaps ，而用于管理它们的工具 snapd 可在多种 Linux 发行版 上运行，并允许 上游 软件开发者直接将他们的应用程序分发给用户。Snaps 是自包含的应用程序，在沙盒中运行，并通过中介访问主机系统。Snap 最初是为 云 应用程序发布的1，但后来被移植到 物联网 设备34 和桌面56 应用程序上。 其他 snap 的漏洞利用...

HTB-Facts-Writeup

HackTheBox — Facts 机器解析 机器信息 字段| 详情 ---|--- 名称| Facts 操作系统| Linux 难度| Easy 发布赛季| 第10赛季 退役状态| 否 攻击链概览 root@kitploit: Recon → Web Enumeration → CVE-2025-2304 Mass Assignment → S3/MinIO Credential Leak → SSH Key Extraction → Passphrase Cracking → User Shell → facter Sudo Abuse → Root 使用的工具 侦察 端口扫描...

PYSEC-2026-2596 Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases

Summary The SQLite databases are created at predictable static paths in /tmp. Any user can therefore create a symlink at these paths in /tmp pointing to arbitrary files. The monitoring scripts then follows these symlinks and then creates their database at the symlink target. This becomes really...

CVE-2025-41761

A low‑privileged local attacker who gains access to the UBR service account e.g., via SSH can escalate privileges to obtain full system access. This is due to the service account being permitted to execute certain binaries e.g., tcpdump and ip with sudo...

EUVD-2025-208369

A low‑privileged local attacker who gains access to the UBR service account e.g., via SSH can escalate privileges to obtain full system access. This is due to the service account being permitted to execute certain binaries e.g., tcpdump and ip with sudo...

linux-privilege-escalation-oscp-guide

🔥 Cyber Public School – Linux Privilege Escalation Ultra Guide...

CVE-2021-41021

A privilege escalation vulnerability in FortiNAC versions 8.8.8 and below and 9.1.2 and below may allow an admin user to escalate the privileges to root via the sudo command...

CVE-2021-24011

A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges...

DEBIAN-CVE-2023-30630

Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. NOTE: Some third parties have indicated the fix in 3.5 does not adequately address the vulnerability. The argument is that the proposed...

sssd: shell command injection in sssctl

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest...

CVE-2021-24011

A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges...

CVE-2021-24011

A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges...

Fortinet FortiNAC 权限许可和访问控制问题漏洞

Fortinet FortiNAC is a set of network access control solutions from the U.S. company Fita Fortinet. The product is primarily used for network access control and IoT security. FortiNAC suffers from a privilege permission and access control issue vulnerability that arises from an application not...

Symantec Web Gateway 5.0.3.18 LFI Remote ROOT RCE Exploit

Exploit for linux platform in category remote exploits !/usr/bin/python ''' The original patch for the Symantec Web Gateway 5.0.2 LFI vulnerability removed the /tmp/networkScript file but left the entry in /etc/sudoers, allowing us to simply recreate the file and obtain a root shell using a...