Networked

[root@networked ~] #

g00t r00t.
Very amazing box.
I must say I learnt a lot since I don’t do so much linux boxes.

Thanks to @rholas and @vhash for giving me the right hints.

FootHold :
Find the hidden web directory and google how you can use magic bytes to go through limitations.

User : Find the hidden script, find out as what user it runs as and learn how you can “touch” it to get to the user.

Root: again find the hidden script and check how you can exploit it. Tip: Google helped me learn how to exploit it.

Report if spoiler.

if anyone wants to give me a hand for initial foothold…
understand what needs to be done…
found the files, can bypass the filter… but struggling to actually find a file I can then execute…

User took me awhile, but I eventually got it. I came back to root today and it didn’t take me too long. I’m new to this kind of stuff to begin with so I’m surprised I got any of it at all.

My hints, hopefully these are just the right level of vague:

User


  • After your foothold, look to establish a more-preferred means of executing your commands
  • If necessary, run stuff locally and watch what’s actually happening. I got caught up on one part of the logic which ended up being irrelevant.
  • The methodology behind this pivot is much simpler than you’re thinking it is, in my opinion. It’s about leveraging what’s there (without modification) to make it do what you want to do.

Root


  • Don’t forget to enumerate!
  • This escalation is very similar to the user escalation.
  • What are you allowed to do with your new-found identity? Anything extra? Anything overpowered?
  • Again, more simple than you might think. Everything you need is in front of you, no modifications or additional complexity needed.

Hopefully these help. Feel free to PM me for any additional hints, I’ll do what I can.

Rooted.
User took days but then root was easy if you understand the script, for user it was my mistake that i saw something at u***d and ignore it to try… so try each and every thing which you see during your enumerating.

Special Thanks to @lucxfer for all his help and guidance… otherwise really stuck at user part.

I can’t even work out where to start

Is there some problems with the server? I know how to get user, it’s obvious, but it seems the cron doesn’t work, because I’ve been waiting for hour. Or maybe I’m doing something completely wrong?

Got root and was doing everything right. Sometimes you need to reset a machine if cron isn’t working.

Hint for root: google files that might be interesting

Hints for ROOT?, I’m stucked on ch******.s***

Type your comment> @codebear said:

G’day all again,

I’m getting into a rhythm of rooting boxes and as always the forum is a source of great inspiration and I always like to give back.

Just to note for this box I’m on a private server so I didn’t get any spoilers but a big shout out to @letMel00kDeepr, @LastC0de and @Apr4h for nudges on the USER portion.

INITIAL FOOTHOLD: This is pretty straight forward, think double ext and magic bytes. I picked this up from an IPPSEC video (although I can’t remember which one).

USER: The hints in here are TOUCH and you’ll need a special character ‘;’. Figure out where this needs to go and be patient. If you’re on the free server you’ll probs get this straight away.

ROOT: Basic privesc will lead you and then read code again.

If you need help PM me.

what do u mean by TOUCH?

Finally rooted, for me the root part was the most difficult part

If someone stuck on getting user shell, read nc man carefully.

Got a low priv shell, now trying to get user. I saw when something runs, and got ca.***. Also thanks to leftovers/forumposts I get what should be done. However I cant figure out exactly what and why it should work, anyone I could PM for a hint?

Any chance I could get a hint on viewing u*.tt? Got shell as A***e, looked through c_a but not any good with understanding what it means. Think I understand the ‘touch’ reference but not sure how to make use of it. PM’s are welcome :slight_smile:

Type your comment> @kalagan76 said:

I’m almost at the point were i’m going to throw my laptop out of the windows. I’ve been stucked for days now.

I’m on the box as ae and trying to get a shell as g. I’ve read a lot about c*****d in and understand how it work but just not in the context of the ck_a*k.php and cron files.

I don’t understand where i could inject the command…i’ve try to create a file, upload a file with the command in the name, etc…

Help!! :frowning:

Same here! :frowning:
Can anybody help me to understand where to touch?
DM please

It was mentioned earlier in this thread, the best hint for user is:

https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt

if you can understand what the article is about you should understand what you need to do for user

Rooted, but I think I don’t fully understand why particular input worked in root part (certain sign in passed variable/command and its usage in **c* command in ***n***a**.*h script). I would be grateful if somebody could DM me with short explanation, just to exchange experience and gain some knowledge.

Cheers

For root, if my search was correct, CentOS team says that that technique used for privilege escalation its not an issue :smiley:

Type your comment> @jish2002 said:

I can’t even work out where to start

Try to enumerate files and directories on the server. Maybe you find a file or a directory that stands out, that you think should not be there, then take a look at that and ponder what you can actually do.

Remember: These boxes are made to be hacked. What you find is usually a very good hint at what you can use.

Ok. I still try to upload stuff on the place for uploading stuff. After a bit of googling i got that i need to change some stuff in b*** S***. The problem is that it is still not working. Can someone give me a hand? All PMs are welcome.

I am totally stuck with low priv access. I see u****s but whatever i upload is never there except a dot. really in need of a nudge.

Type your comment> @XanderCrews said:

It was mentioned earlier in this thread, the best hint for user is:

https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt

if you can understand what the article is about you should understand what you need to do for user

Thanks for posting this it was really helpful. I read it on an earlier comment and it was the first useful hint I got from this thread and helped me get user.

rooted anyone who needs help can DM me.