Introduction
This is my write-up for TryHackMe's Bounty Hacker Room.
Downloading and checking the files, I see that one of them look like a password list.
The 2nd file, contains a list of things to do. The writer of the list might be a user.
Exploitation
Running hydra using the password list found at the FTP, I was able to get the SSH credentials.
Connecting via SSH, I was able to verify the above credentials.
Privilege Escalation
Checking for sudo privileges, I found that I could user tar for privilege escalation.
Checking GTFOBins, I can run something like:
sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh
Trying something similar to that above out, I was able to gain root access.
No comments:
Post a Comment