TryHackMe write-up: Brooklyn Nine Nine (Second Method)

Introduction

This is my 2nd write-up for TryHackMe's Brooklyn Nine Nine Room.  According to the room description, there are 2 ways to root the box.  The first method was described in my earlier post.  The 2nd method will be described here.

Enumeration

Using nmap, I saw that this box is running FTP, SSH and HTTP.

It turns out, FTP allows anonymous access.

 

Downloading the note, I found that one user uses a weak password.

Exploitation

Running hydra, I quickly find the password.

Using the cracked password, I was able to SSH to the target.

A simple find command allowed me to find the location of user.txt.  Turns out I have read access to it.

Privilege Escalation

Checking for sudo privileges, I found that I could run "less" under sudo.

According to GTFOBins, "less" can be used to elevate privileges.

Running "sudo /usr/bin/less /etc/profile" opens /etc/profile inside the "less" viewer.  Following the instructions from GTFOBins, I typed in the following from inside "less":

!/bin/sh

This started "sh" as root, thus giving me elevated privileges.  I was then able to view the contents of root.txt.