Privilege Escalation

Finding User file:

First I used sudo-l to check my privileges

So I can run a command as rabbit. interesting. I looked at what this python file was. I've cut most of it out (of the screenshot) as it was a poem.

It seems to import random which is convenient. We can do something called python library hijacking. If we place a random.py file in the same directory when import random runs it will use our python file instead of the random.py library python file.

creating my random py script

what i wrote in python script

Now as you can see I have successfully created a shell as "rabbit"

Now in rabbit I looked around the directories and a binary called tea party

Initially I wanted to copy the file back to my system using python3 and http server then making a strng on the file in my main system to see the kind of calls it makes and ultimately hijack the path and take over the date binary but that did not work (for me)

instead I tried a different. First I needed to give myself permission to download the file while in the rabbit shell with "chmod 777 /home/rabbit"

Then in a new terminal tab I would use sudo scp (secure copy protocol)

I can still analyse the binary file using strings

As we can see the echo is being called by its absolute path but the date is not being called, something I can try to exploit with the environment variable priv escalation method.

I create a nano file called date

What i am doing now is, I am using home rabbit as one of the paths in the env variable. Now when the file starts to look for a date it is going to look through the path i created which should run bin/bash giving me shell access.

it didnt initially work, but after a slight chmod change to executable permission it worked.

2 ways to move forward, we can do standard enumeration using linpeas and see that /usr/bin/perl has cap_setuid+ep capabilities or use a quick command that is specific for listing capabilities for binaries for further exploitation "getcap -r / 2>/dev/null"

Im going to look for the capabilities regarding perl. First I need to go to GTFObins and select perl > capabilities which should get me the command

I've tried previously to execute the command but there was a password requirement. I thought to look around and found it within the hatter directory. Even though I found the password I was still not able to run the command.

So i decided with the password and the information I already have, I could just SSH into hatter@ip and try to execute the command there.

Now that I am root I can find the files I need for the flag