🚩
THM Walkthroughs
  • THM Walkthroughs
    • 🧑‍🏫Tutorial
  • 🟦Difficulty: Info
    • 🔌What is Networking?
    • 🔌Intro to LAN
    • 🐧Linux Fundamentals
      • 🐧Linux Fundamentals Part 1
        • Task 2 - A Bit of Background on Linux
        • Task 4 - Running Your First few Commands
        • Task 5 - Interacting With the Filesystem!
        • Task 6 - Searching for Files
        • Task 7 - An Introduction to Shell Operators
      • 🐧Linux Fundamentals Part 2
        • Task 3 - Introduction to Flags and Switches
        • Task 4 - Filesystem Interaction Continued
        • Task 5 - Permissions 101
        • Task 6 - Common Directories
      • 🐧Linux Fundamentals Part 3
        • Task 3 - Terminal Text Editors
        • Task 4 - General/Useful Utilities
        • Task 5 - Processes 101
        • Task 6 - Maintaining Your System: Automation
        • Task 8 - Maintaining Your System: Logs
    • 🪟Windows Fundamentals
      • 🪟Windows Fundamentals 1
      • 🪟Windows Fundamentals 2
      • 🪟Windows Fundamentals 3
    • 🔓Principles of Security
    • 🐍Python Basics
    • 🔍History of Malware
    • 🦹Common Attacks
    • 🖥️Security Awareness
    • ⚔️Intro to Offensive Security
    • 🦹Pentesting Fundamentals
    • 🔓CVE Walkthroughs
      • 🖥️Sudo Security Bypass: CVE-2019-14287
      • 🖥️Sudo Buffer Overflow: CVE-2019-18634
      • 🖥️Baron Samedit: CVE-2021-3156
      • 🖥️OverlayFS: CVE-2021-3493
      • 🖥️Polkit: CVE-2021-3560
      • 🖥️Pwnkit: CVE-2021-4034
      • 🪶Apache HTTP Server Path Traversal: CVE-2021-41773/42013
      • 🧻Dirty Pipe: CVE-2022-0847
      • 🟢Spring4Shell: CVE-2022-22965
    • 🟧Burp Suite
      • 🟧Burp Suite: The Basics
      • 🟧Burp Suite: Repeater
    • 🏁Challenges
      • ⤴️Bypass Disable Functions
    • 🎟️THM PROMOs
      • 🎟️Learn and win prizes [PROMO ENDED]
      • 🎟️Learn and win prizes #2 [PROMO ENDED]
  • 🟩Difficulty: Easy
    • 🚀Learning Cyber Security
    • 🔁The Hacker Methodology
    • 🔍Google Dorking
      • Task 2 - Let's Learn About Crawlers
      • Task 4 - Beepboop - Robots.txt
      • Task 5 - Sitemaps
      • Task 6 - What is Google Dorking?
    • 🐝OWASP Top 10
      • Task 5 - Command Injection Practical
      • Task 7 - Broken Authentication Practical
      • Task 11 - Sensitive Data Exposure (Challenge)
      • Task 13 - XML External Entity - eXtensible Markup Language
      • Task 14 - XML External Entity - DTD
      • Task 16 - XML External Entity - Exploiting
      • Task 18 - Broken Access Control (IDOR Challenge)
      • Task 19 - Security Misconfiguration
      • Task 20 - Cross-site Scripting
      • Task 21 - Insecure Deserialization
      • Task 24 - Insecure Deserialization - Cookies
      • Task 25 - Insecure Deserialization - Cookies Practical
      • Task 30 - Insufficient Logging and Monitoring
    • 📡Nmap
      • Task 2 - Introduction
      • Task 3 - Nmap Switches
      • Task 5 - TCP Connect Scans
      • Task 6 - Scan Types SYN Scans
      • Task 7 - UDP Scans
      • Task 8 - NULL, FIN and Xmas
      • Task 9 - ICMP Network Scanning
      • Task 10 - NSE Scripts Overview
      • Task 11 - Working with the NSE
      • Task 12 - Searching for Scripts
      • Task 13 - Firewall Evasion
      • Task 14 - Practical
    • 📡RustScan
      • Task 2 - Installing RustScan
      • Task 5 - Extensible
      • Task 7 - Scanning Time!
      • Task 8 - RustScan Quiz
    • 🐙Crack the hash
    • 🌍OhSINT
    • 🧑‍🚀Vulnversity
    • 🧊Ice
    • 🪟Blue
    • 🎄Advent of Cyber 4 (2022)
  • 🟨Difficulty: Medium
    • 🪟Attacktive Directory
      • Task 3 - Welcome to Attacktive Directory
      • Task 4 - Enumerating Users via Kerberos
      • Task 5 - Abusing Kerberos
      • Task 6 - Back to the Basics
      • Task 7 - Elevating Privileges within the Domain
      • Task 8 - Flag Submission Panel
    • 💀Mr Robot CTF
    • 🛗Linux PrivEsc
    • 🛗Linux PrivEsc Arena [WIP]
    • 🛗Windows PrivEsc Arena
  • 🟧Difficulty: Hard
    • 🐘Hacking Hadoop [WIP]
  • 🟥Difficulty: Insane
    • ⛺You're in a cave [WIP]
  • Blank Room (Duplicate Me)
Powered by GitBook
On this page
  • Task 1 - Info Introduction and Deploy
  • Deploy the machine by clicking on the green "Deploy" button at the top of this task!
  • Task 2 - Tutorial Vulnerability Background
  • Read the information in the task and understand how Dirty Pipe works.
  • Task 3 - Practical A Weaponised PoC
  • Follow along with the steps described in the task if you haven't already done so.
  • Switch user (su) into your newly created root account. What is the flag found in the /root/flag.txt file?
  • As mentioned previously, we have accidentally overwritten other user accounts by exploiting Dirty Pipe in this manner. This could cause issues for the server; thus, as professionals, we must clean up after our exploits. Using your root shell, restore the original /etc/passwd file from your backup.
  • Task 4 - Practical Bonus Task A Second Exploit
  • Exploit the target using bl4sty's exploit for Dirty Pipe
  • Make sure to clean up after yourself! Remove the SUID binary created by the script (/tmp/sh).
  • [Optional] Find another exploit for this vulnerability online. Review the code to ensure that it does what it claims to do, then upload it to the target and attempt to exploit the vulnerability a third way.
  • Task 5 - Info Conclusion
  • I understand the Dirty Pipe vulnerability!
  1. Difficulty: Info
  2. CVE Walkthroughs

Dirty Pipe: CVE-2022-0847

Interactive lab for exploiting Dirty Pipe (CVE-2022-0847) in the Linux Kernel

PreviousApache HTTP Server Path Traversal: CVE-2021-41773/42013NextSpring4Shell: CVE-2022-22965

Last updated 2 years ago

Room Attributes
Value

Subscription Required

False [Free]

Type

Walkthrough

Difficulty

Info

Tags

Dirty Pipe, CVE-2022-0847, Linux, Kernel

Task 1 - Info Introduction and Deploy

Deploy the machine by clicking on the green "Deploy" button at the top of this task!

No answer needed

Task 2 - Tutorial Vulnerability Background

Read the information in the task and understand how Dirty Pipe works.

No answer needed

Task 3 - Practical A Weaponised PoC

Follow along with the steps described in the task if you haven't already done so.

No answer needed

Switch user (su) into your newly created root account. What is the flag found in the /root/flag.txt file?

As mentioned previously, we have accidentally overwritten other user accounts by exploiting Dirty Pipe in this manner. This could cause issues for the server; thus, as professionals, we must clean up after our exploits. Using your root shell, restore the original /etc/passwd file from your backup.

No answer needed

Task 4 - Practical Bonus Task A Second Exploit

Exploit the target using bl4sty's exploit for Dirty Pipe

No answer needed

Make sure to clean up after yourself! Remove the SUID binary created by the script (/tmp/sh).

No answer needed

[Optional] Find another exploit for this vulnerability online. Review the code to ensure that it does what it claims to do, then upload it to the target and attempt to exploit the vulnerability a third way.

No answer needed

Task 5 - Info Conclusion

I understand the Dirty Pipe vulnerability!

No answer needed

Reveal Flag

THM{MmU4Zjg0NDdjNjFiZWM5ZjUyZGEyMzlm}

🟦
🔓
🧻
🚩
🚩
TryHackMe | Dirty Pipe: CVE-2022-0847TryHackMe
https://tryhackme.com/room/dirtypipe
Logo