Todd

Writeup HackMyVM

Todd

Yeah, aftter long time i'm back guys!! Hope y'all doing great! Todd is an easy difficulty Linux machine from HackMyVM platfrom! VM Link

Enumeration

>> Find the IP address of our Target in our virtual network, with netdiscover

  • Our target ip is 192.168.1.15 .

>> Let's do begin with nmap scan

7066 Port looks Intresting!!

Let's Visit the Webpage.

FireFox

Just an static site!

>> Brute Force files and subdirectories with gobuster

lets visit the http://192.168.1.15/tools/

Found some tools on the /tools

Maybe we could use this tool

  • fscan: vulnerability scanner

  • les.sh: Linux privilege escalation auditing tool

  • linpeas.sh: Linux Privilege Escalation Awesome Script

  • pspy64: Monitor linux processes without root permissions

Now back to the port

Let's try to connecting with netcat

But after some time it will automatically disconnects.

Exploitation

Let's look around what we can find!

Yay! we got the user flag!

Stable Shell

We need to get a stable shell, so here we can use SSH key.

On victim machine :

Now, on our attacker machine, generate an SSH key:

Now add the contents of attacker.pub to authorized_keys on victim machine :

Now Log In :

And we're in!

Privilege Escalation

Le's Look around

SSH session randomly closed.

Let's Look for permissions.

We again disconnected from the session! this because of the kill_todd.sh . So Let's remove it.

Now let's look at the script /guess_and_check.sh

Scipt Logic :

  • Picks a random number between 0 and 999, stores in variable a and waits for user input.

  • If it's doesn't matches then it exits.

  • Then it creates two file paths in /tmp/, one as true_file and one as false_file.

  • If true_file exists, and false_file does NOT, it prints /root/.cred.

Because the filenames are generated using random numbers between 0 and 999, So we will manually create the file in /tmp folder. So this will get the true_file .

Now run the scirpt with sudo

We've got the root creds!!

Let's switch to root.

And Finally We have the ROOT Flag!! 🚨

https://hackmyvm.eu/achievement/?achievement=31188

PreviousNebula

Last updated