https://osiriz.dev/tags/privesc/Recent content in privesc on OsirizHugo -- gohugo.ioen-usWed, 24 Apr 2024 11:00:00 +0200https://osiriz.dev/posts/2024/04/ddc-2024-regionals-challenge-21/Wed, 24 Apr 2024 11:00:00 +0200https://osiriz.dev/posts/2024/04/ddc-2024-regionals-challenge-21/We are given the following url: http://toolbox.hkn Visiting the site we see that it is a toolbox of network diagnostic tools. If we look at the ping tool we can see that we are able to run other bash commands by separating them with a ;: We sadly cant just read the flag: We can see that this is because it is owned by root and only root has read permissions: So lets upload a revshell so then try and privesc from there.https://osiriz.dev/posts/2024/04/ddc-2024-regionals-cron-my-tab/Wed, 24 Apr 2024 11:00:00 +0200https://osiriz.dev/posts/2024/04/ddc-2024-regionals-cron-my-tab/We are told that we can login over ssh at crontab.hkn using the username:password pair doomguy:doomguysEcReTpAsSwOrD, and to run tail -f read.sh.log. Logging in we are also told that crontab is running /etc/read.sh. So lets check the crontab, checking in /etc/cron.d/ we find execute-cron containing the line: * * * * * /etc/read.sh >> /home/doomguy/read.sh.log So the /etc/read.sh script is run every minute, lets check the permissions on the script: