Horizontal escalation

We have already learned how to spawn a TTY shell by performing enumeration. In this recipe, we will look at some of the methods where horizontal escalation can be performed to gain more privileges on the system.

How to do it...

Let's perform the following steps:

1. Here, we have a situation where we have got a reverse shell, www-data.
2. Run sudo --list. We will find that the user is allowed to open a configuration file as another user, waldo:

3. We need to open up the file in the VI Editor. To get a shell in VI, we must type the following:

!bash

After executing the !bash command, we get the following screen:

4. We now have a shell with the waldo user. Our escalation was successful.
5. In some cases, we...