Mirrors/CTF-Writeups
2
0
Fork 0
mirror of https://github.com/AbdullahRizwan101/CTF-Writeups synced 2024-11-21 19:43:03 +00:00
Code Issues Projects Releases Packages Wiki Activity

Create cretin.md

Browse source
This commit is contained in:
ARZ 2021-12-04 19:25:52 +05:00 committed by GitHub
parent a22b6ef139
commit 9255a4198d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 42 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
echoCTF/cretin.md Normal file
View file

@ -0,0 +1,42 @@
# echoCTF - Cretin
We can find the first flag by printing the environmental variable `env`after connecting with `nc`
<img src="https://i.imgur.com/W3pfD6y.png"/>
## Privilege Escalation (dribble)
Running `sudo -l` we can see that this user can run`ed` binary as `dribble` user
<img src="https://i.imgur.com/yUcCpkO.png"/>
So looking at GTFOBINS
<img src="https://i.imgur.com/xCVTDQ4.png"/>
<img src="https://i.imgur.com/gH0MIhH.png"/>
## Privilege Escalation (scribble)
Again running sudo -l we can see this user can now run `capsh` binary as `scribble` user
<img src="https://i.imgur.com/CKRs4Zu.png"/>
<img src="https://i.imgur.com/CQCgPnI.png"/>
## Privilege Escalation (ETSCTF)
This is the last priv esc that we need to do , we can run `whiptail` as `ETSCTF` user
<img src="https://i.imgur.com/d0E4RS4.png"/>
<img src="https://i.imgur.com/epD2yyq.png"/>
Running that we will get ambiguous redirect , so this isn't actually a binary but a script which is running the actual whiptail binary
<img src="https://i.imgur.com/YnGY3XY.png"/>
We just need to specify the file name to read as the privesc is already included here
<img src="https://i.imgur.com/3plgxnf.png"/>
<img src="https://i.imgur.com/VfmywhW.png"/>