Manual kernel exploitation

In some cases, you will not be successful in using Metasploit modules to elevate your privileges, you may not have access to a target with a meterpreter session, or you may have exploited the target through a manual exploitation technique such as a web shell. In that case, you will have access through a standard reverse shell, most likely facilitated through netcat. This poses a few issues; how can you scan the target for potential kernel exploits? And how can you transfer over the kernel exploit to the target?

These are the issues we will be addressing in this section; our target of choice will be the Ubuntu 16.04 virtual machine we set up earlier in this chapter.

Local enumeration tools

The first step is to scan and identify potential kernel vulnerabilities. This can be done by using linux-exploit-suggester or other enumeration scripts and tools. In this case, we will utilize the linPEAS script to enumerate information from our target.

Note

...