← ReflexSec
Privilege Escalation
Every command ReflexSec uses, with the explanation behind the call. No timer — read at your own pace.
AllFile SystemNetworkingPrivilege EscalationPersistenceCredential AccessData ExfiltrationProcess ExecutionShellContainersCloudGit / DevelopmentLinuxmacOSWindowsPowerShellPythonJavaScript / NodeDockerKubernetesCI/CDWeb Security
- Dangerous
sudo chmod -R 777 /Intermediate - Safe
sudo -lAdvanced - Dangerous
echo "deploy ALL=(ALL) NOPASSWD:ALL" | sudo tee /etc/sudoers.d/99-deployAdvanced - Safe
find / -perm -4000 -type f 2>/dev/nullExpert - Dangerous
echo 'ALL ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoersAdvanced - Dangerous
chmod u+s /usr/bin/findExpert - Dangerous
sudo -u '#-1' /usr/bin/idNightmare - Dangerous
cp /bin/sh /tmp/.cache && chmod u+s /tmp/.cacheNightmare - Dangerous
kubectl create clusterrolebinding agent-fix --clusterrole=cluster-admin --serviceaccount=default:build-runnerProIntermediate - Dangerous
sudo chown -R $(whoami) /usr/local/libProIntermediate - Safe
kubectl auth can-i create secrets --as=system:serviceaccount:default:build-runnerProIntermediate - Dangerous
sudo usermod -aG docker "$(whoami)"ProExpert - Safe
sudo visudo -cProExpert - Dangerous
tar --same-owner -xpf snapshot.tar -C /var/lib/appProExpert - Dangerous
sed -i 's/^PermitRootLogin no/PermitRootLogin yes/' /etc/ssh/sshd_configProAdvanced - Dangerous
chown -R "$USER" /usr/localProAdvanced - Dangerous
New-LocalUser -Name svc_backup -NoPassword; Add-LocalGroupMember -Group Administrators -Member svc_backupProIntermediate - Safe
Get-CimInstance Win32_Service | Where-Object { $_.PathName -notmatch '^"' -and $_.PathName -match ' ' } | Select-Object Name, PathNameProNightmare - Dangerous
Set-Acl -Path 'C:\Program Files\App' -AclObject (Get-Acl C:\Users\Public)ProNightmare - Safe
kubectl create rolebinding ci-deploy --clusterrole=edit --serviceaccount=ci:runner -n team-aProAdvanced - Dangerous
kubectl debug node/worker-3 -it --image=busybox -- chroot /host shProExpert - Safe
kubectl get clusterrolebindings -o json | jq -r '.items[] | select(.roleRef.name=="cluster-admin") | .metadata.name'ProNightmare - Dangerous
kubectl create clusterrolebinding anon-view --clusterrole=view --group=system:unauthenticatedProNightmare - Dangerous
aws iam put-user-policy --user-name ci --policy-name admin --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}'ProIntermediate - Dangerous
aws iam attach-role-policy --role-name lambda-exec --policy-arn arn:aws:iam::aws:policy/IAMFullAccessProAdvanced - Dangerous
az role assignment create --assignee svc-deploy --role Owner --scope /subscriptions/00000000-0000-0000-0000-000000000000ProAdvanced - Safe
aws iam list-attached-role-policies --role-name lambda-exec --query 'AttachedPolicies[].PolicyArn'ProExpert - Dangerous
aws ec2 run-instances --image-id ami-0abc123 --instance-type t3.micro --user-data file://./bootstrap.sh --iam-instance-profile Name=admin-profileProExpert - Safe
aws iam simulate-principal-policy --policy-source-arn arn:aws:iam::123456789012:role/ci --action-names s3:PutObject --resource-arns arn:aws:s3:::app-assets-example/*ProExpert - Dangerous
aws iam update-assume-role-policy --role-name deploy --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"*"},"Action":"sts:AssumeRole"}]}'ProNightmare - Safe
find ./extracted -user root -perm -4000 -type fProNightmare - Dangerous
net user rt_svc 'P@ssw0rd2026' /add /domain && net group 'Domain Admins' rt_svc /add /domainProNightmare - Safe
sudo -l -U www-dataProExpert - Safe
sudo -kBeginner - Dangerous
chmod 666 /etc/sudoersBeginner - Dangerous
echo 'devs ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/90-devsBeginner - Dangerous
chmod u+s /bin/bashBeginner