> For the complete documentation index, see [llms.txt](https://aditya-3.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aditya-3.gitbook.io/oscp/readme/privilege-escalation/linux/logrotate.md).

# ↻ logrotate

* [ ] config: `/etc/logrotate.conf`
  * [ ] To exploit we need following:
    * [ ] we need *write permissions* on the log file
    * [ ] logrotate must run as a *privileged user or root*
    * [ ] vulnerable versions: *3.8.6, 3.11.0, 3.15.0, 3.18.0*
  * [ ] Check `cat /var/lib/logrotate.status` to force rotate use `-f`
  * [ ] Use this [exploit](https://github.com/whotwagner/logrotten) with payload as and check which option is used in logrotate.conf with `grep "create\|compress" /etc/logrotate.conf | grep -v "#"` and run with `./logrotten -p ./payload /tmp/tmp.log` where tmp.log is a writable log file