đŸš©
THM Walkthroughs
  • THM Walkthroughs
    • đŸ§‘â€đŸ«Tutorial
  • 🟩Difficulty: Info
    • 🔌What is Networking?
    • 🔌Intro to LAN
    • 🐧Linux Fundamentals
      • 🐧Linux Fundamentals Part 1
        • Task 2 - A Bit of Background on Linux
        • Task 4 - Running Your First few Commands
        • Task 5 - Interacting With the Filesystem!
        • Task 6 - Searching for Files
        • Task 7 - An Introduction to Shell Operators
      • 🐧Linux Fundamentals Part 2
        • Task 3 - Introduction to Flags and Switches
        • Task 4 - Filesystem Interaction Continued
        • Task 5 - Permissions 101
        • Task 6 - Common Directories
      • 🐧Linux Fundamentals Part 3
        • Task 3 - Terminal Text Editors
        • Task 4 - General/Useful Utilities
        • Task 5 - Processes 101
        • Task 6 - Maintaining Your System: Automation
        • Task 8 - Maintaining Your System: Logs
    • đŸȘŸWindows Fundamentals
      • đŸȘŸWindows Fundamentals 1
      • đŸȘŸWindows Fundamentals 2
      • đŸȘŸWindows Fundamentals 3
    • 🔓Principles of Security
    • 🐍Python Basics
    • 🔍History of Malware
    • đŸŠčCommon Attacks
    • đŸ–„ïžSecurity Awareness
    • ⚔Intro to Offensive Security
    • đŸŠčPentesting Fundamentals
    • 🔓CVE Walkthroughs
      • đŸ–„ïžSudo Security Bypass: CVE-2019-14287
      • đŸ–„ïžSudo Buffer Overflow: CVE-2019-18634
      • đŸ–„ïžBaron Samedit: CVE-2021-3156
      • đŸ–„ïžOverlayFS: CVE-2021-3493
      • đŸ–„ïžPolkit: CVE-2021-3560
      • đŸ–„ïžPwnkit: CVE-2021-4034
      • đŸȘ¶Apache HTTP Server Path Traversal: CVE-2021-41773/42013
      • đŸ§»Dirty Pipe: CVE-2022-0847
      • 🟱Spring4Shell: CVE-2022-22965
    • 🟧Burp Suite
      • 🟧Burp Suite: The Basics
      • 🟧Burp Suite: Repeater
    • 🏁Challenges
      • ‎Bypass Disable Functions
    • đŸŽŸïžTHM PROMOs
      • đŸŽŸïžLearn and win prizes [PROMO ENDED]
      • đŸŽŸïžLearn and win prizes #2 [PROMO ENDED]
  • đŸŸ©Difficulty: Easy
    • 🚀Learning Cyber Security
    • 🔁The Hacker Methodology
    • 🔍Google Dorking
      • Task 2 - Let's Learn About Crawlers
      • Task 4 - Beepboop - Robots.txt
      • Task 5 - Sitemaps
      • Task 6 - What is Google Dorking?
    • 🐝OWASP Top 10
      • Task 5 - Command Injection Practical
      • Task 7 - Broken Authentication Practical
      • Task 11 - Sensitive Data Exposure (Challenge)
      • Task 13 - XML External Entity - eXtensible Markup Language
      • Task 14 - XML External Entity - DTD
      • Task 16 - XML External Entity - Exploiting
      • Task 18 - Broken Access Control (IDOR Challenge)
      • Task 19 - Security Misconfiguration
      • Task 20 - Cross-site Scripting
      • Task 21 - Insecure Deserialization
      • Task 24 - Insecure Deserialization - Cookies
      • Task 25 - Insecure Deserialization - Cookies Practical
      • Task 30 - Insufficient Logging and Monitoring
    • 📡Nmap
      • Task 2 - Introduction
      • Task 3 - Nmap Switches
      • Task 5 - TCP Connect Scans
      • Task 6 - Scan Types SYN Scans
      • Task 7 - UDP Scans
      • Task 8 - NULL, FIN and Xmas
      • Task 9 - ICMP Network Scanning
      • Task 10 - NSE Scripts Overview
      • Task 11 - Working with the NSE
      • Task 12 - Searching for Scripts
      • Task 13 - Firewall Evasion
      • Task 14 - Practical
    • 📡RustScan
      • Task 2 - Installing RustScan
      • Task 5 - Extensible
      • Task 7 - Scanning Time!
      • Task 8 - RustScan Quiz
    • 🐙Crack the hash
    • 🌍OhSINT
    • 🧑‍🚀Vulnversity
    • 🧊Ice
    • đŸȘŸBlue
    • 🎄Advent of Cyber 4 (2022)
  • 🟹Difficulty: Medium
    • đŸȘŸAttacktive Directory
      • Task 3 - Welcome to Attacktive Directory
      • Task 4 - Enumerating Users via Kerberos
      • Task 5 - Abusing Kerberos
      • Task 6 - Back to the Basics
      • Task 7 - Elevating Privileges within the Domain
      • Task 8 - Flag Submission Panel
    • 💀Mr Robot CTF
    • 🛗Linux PrivEsc
    • 🛗Linux PrivEsc Arena [WIP]
    • 🛗Windows PrivEsc Arena
  • 🟧Difficulty: Hard
    • 🐘Hacking Hadoop [WIP]
  • đŸŸ„Difficulty: Insane
    • â›șYou're in a cave [WIP]
  • Blank Room (Duplicate Me)
Powered by GitBook
On this page
  • Task 1 Deploy the Vulnerable Debian VM
  • Deploy the machine and login to the "user" account using SSH.
  • Run the "id" command. What is the result?
  • Task 2 Service Exploits
  • Read and follow along with the above.
  • Task 3 Weak File Permissions - Readable /etc/shadow
  • What is the root user's password hash?
  • What hashing algorithm was used to produce the root user's password hash?
  • What is the root user's password?
  • Task 4 Weak File Permissions - Writable /etc/shadow
  • Read and follow along with the above.
  • Task 5 Weak File Permissions - Writable /etc/passwd
  • Run the "id" command as the newroot user. What is the result?
  • Task 6 Sudo - Shell Escape Sequences
  • How many programs is "user" allowed to run via sudo?
  • One program on the list doesn't have a shell escape sequence on GTFOBins. Which is it?
  • Consider how you might use this program with sudo to gain root privileges without a shell escape sequence.
  • Task 7 Sudo - Environment Variables
  • Read and follow along with the above.
  • Task 8 Cron Jobs - File Permissions
  • Read and follow along with the above.
  • Task 9 Cron Jobs - PATH Environment Variable
  • What is the value of the PATH variable in /etc/crontab?
  • Task 10 Cron Jobs - Wildcards
  • Read and follow along with the above.
  • Task 11 SUID / SGID Executables - Known Exploits
  • Read and follow along with the above.
  • Task 12 SUID / SGID Executables - Shared Object Injection
  • Read and follow along with the above.
  • Task 13 SUID / SGID Executables - Environment Variables
  • Read and follow along with the above.
  • Task 14 SUID / SGID Executables - Abusing Shell Features (#1)
  • Read and follow along with the above.
  • Task 15 SUID / SGID Executables - Abusing Shell Features (#2)
  • Read and follow along with the above.
  • Task 16 Passwords & Keys - History Files
  • What is the full mysql command the user executed?
  • Task 17 Passwords & Keys - Config Files
  • What file did you find the root user's credentials in?
  • Task 18 Passwords & Keys - SSH Keys
  • Read and follow along with the above.
  • Task 19 NFS
  • What is the name of the option that disables root squashing?
  • Task 20 Kernel Exploits
  • Read and follow along with the above.
  • Task 21 Privilege Escalation Scripts
  • Experiment with all three tools, running them with different options. Do all of them identify the techniques used in this room?
  1. Difficulty: Medium

Linux PrivEsc

Practice your Linux Privilege Escalation skills on an intentionally misconfigured Debian VM with multiple ways to get root! SSH is available. Credentials: user:password321

PreviousMr Robot CTFNextLinux PrivEsc Arena [WIP]

Last updated 2 years ago

Room Attributes
Value

Subscription Required

False [Free]

Type

Walkthroughs

Difficulty

Medium

Tags

PrivEsc, Privilege Escalation, Linux, Linux Privilege Escalation

Task 1 Deploy the Vulnerable Debian VM

Deploy the machine and login to the "user" account using SSH.

No answer needed

Run the "id" command. What is the result?

Task 2 Service Exploits

Read and follow along with the above.

No answer needed

Task 3 Weak File Permissions - Readable /etc/shadow

What is the root user's password hash?

What hashing algorithm was used to produce the root user's password hash?

HINT: john the ripper should automatically identify it when cracking!

What is the root user's password?

Task 4 Weak File Permissions - Writable /etc/shadow

Read and follow along with the above.

No answer needed

Task 5 Weak File Permissions - Writable /etc/passwd

Run the "id" command as the newroot user. What is the result?

Task 6 Sudo - Shell Escape Sequences

How many programs is "user" allowed to run via sudo?

One program on the list doesn't have a shell escape sequence on GTFOBins. Which is it?

Consider how you might use this program with sudo to gain root privileges without a shell escape sequence.

HINT: Play around with certain options the program has!

No answer needed

Task 7 Sudo - Environment Variables

Read and follow along with the above.

No answer needed

Task 8 Cron Jobs - File Permissions

Read and follow along with the above.

No answer needed

Task 9 Cron Jobs - PATH Environment Variable

What is the value of the PATH variable in /etc/crontab?

Task 10 Cron Jobs - Wildcards

Read and follow along with the above.

No answer needed

Task 11 SUID / SGID Executables - Known Exploits

Read and follow along with the above.

No answer needed

Task 12 SUID / SGID Executables - Shared Object Injection

Read and follow along with the above.

No answer needed

Task 13 SUID / SGID Executables - Environment Variables

Read and follow along with the above.

No answer needed

Task 14 SUID / SGID Executables - Abusing Shell Features (#1)

Read and follow along with the above.

No answer needed

Task 15 SUID / SGID Executables - Abusing Shell Features (#2)

Read and follow along with the above.

No answer needed

Task 16 Passwords & Keys - History Files

What is the full mysql command the user executed?

Task 17 Passwords & Keys - Config Files

What file did you find the root user's credentials in?

Task 18 Passwords & Keys - SSH Keys

Read and follow along with the above.

No answer needed

Task 19 NFS

What is the name of the option that disables root squashing?

Task 20 Kernel Exploits

Read and follow along with the above.

No answer needed

Task 21 Privilege Escalation Scripts

Experiment with all three tools, running them with different options. Do all of them identify the techniques used in this room?

No answer needed

Reveal Flag
Reveal Flag
Reveal Flag
Reveal Flag
Reveal Flag
Reveal Flag
Reveal Flag
Reveal Flag
Reveal Flag
Reveal Flag
Reveal Flag

uid=1000(user) gid=1000(user) groups=1000(user),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev)

$6$Tb/euwmK$OXA.dwMeOAcopwBl68boTG5zi65wIHsc84OWAIye5VITLLtVlaXvRDJXET..it8r.jbrlpfZeMdwD3B0fGxJI0

sha512crypt

password123

uid=0(root) gid=0(root) groups=0(root)

11

apache2

/home/user:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

mysql -h somehost.local -uroot -ppassword123

/etc/openvpn/auth.txt

no_root_squash

🟹
🛗
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
đŸš©
TryHackMe | Linux PrivEscTryHackMe
https://tryhackme.com/room/linuxprivesc
Logo