Wonderland
March 12, 2024
Task 1: Capture the flags
As we can see from the nmap scan above, we can see the http service or port 80 is open so we can just visit it directly from our page and it shows like this.
There's nothing from the page or the source page is seems interesting
As we use the gobuster we can see some hidden subdirectory in the website
By using the gobuster it doesnt go through the subdirectory that it has found and remain finding in that subdirectory. It just stops right after it found that directory
Therefore, I used the dirbuster tool since it gets the job done. We can see here the /r directory is actually the first letter for the word "rabbit"
And once we visited the site, we can see some interesting stuffs.
There is a credential that we found in the source page of the /r/a/b/b/i/t directory
And when we tried to log in to SSH service as alice user we can see here that it is a valid credential
Then we just used the sudo -l command to see the commands that we can run as alice.
The first one is a python file that returns some text.
Just view the python script itself and it reveal that it will import random library from the python and it will execute itself by using the user rabbit.
As we know that having a import in the code. The script will look first in the same directory where the "random" library might come. Then if it doesn't find any named as "random" python script, it will just look into the python root library as a result.
Therefore, we will create a python script or file that will import the /bin/bash file and it will be executed as that user
In simpler term, the code "import random" from the walrus_and_the_carpenter.py will look for the random file in the same directory and it will find our own newly created random.py that will execute /bin/bash. As we know that from sudo -l, it will be run as user rabbit.
Therefore, as we can see below when we run the walrus_and_the_carpenter.py as the user rabbit, we will get the user rabbit.
As we view here the "Probably by Tue, 12 Mar 2024 11:12:01 +0000" line is actually being provide by this line of code. "/bin/echo -n 'Probably by ' && date --date='next hour' -R"
Then we just have to create a executable file that have a similar name to date with the value of /bin/bash so that it will execute the /bin/bash as that user who owns the "teaParty" script.
Then we just have to specify the directory where the malicious file date is located which is in our /tmp directory.
Just run the teaParty script and it will look first for the malicious date script since we changed our $PATH environment to indicate that it will navigate first in the /tmp directory then execute that date file
As we use SSH to the user hatter with the password that we got. We will get a much stable connection to that user instead of just horizontal privilege
Then we will just run linpeas asual and we will see we have some capabilities in the user hatter
We just look for a exploit for this perl executable in the GTFOBins.
And just execute to have a root access
Last updated
