From 9255a4198d632193477af61e0ecd25e7a28f3fbd Mon Sep 17 00:00:00 2001 From: ARZ <60057481+AbdullahRizwan101@users.noreply.github.com> Date: Sat, 4 Dec 2021 19:25:52 +0500 Subject: [PATCH] Create cretin.md --- echoCTF/cretin.md | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 echoCTF/cretin.md diff --git a/echoCTF/cretin.md b/echoCTF/cretin.md new file mode 100644 index 0000000..666f2d2 --- /dev/null +++ b/echoCTF/cretin.md @@ -0,0 +1,42 @@ +# echoCTF - Cretin + +We can find the first flag by printing the environmental variable `env`after connecting with `nc` + + + +## Privilege Escalation (dribble) + +Running `sudo -l` we can see that this user can run`ed` binary as `dribble` user + + + +So looking at GTFOBINS + + + + + +## Privilege Escalation (scribble) +Again running sudo -l we can see this user can now run `capsh` binary as `scribble` user + + + + + +## Privilege Escalation (ETSCTF) + +This is the last priv esc that we need to do , we can run `whiptail` as `ETSCTF` user + + + + + +Running that we will get ambiguous redirect , so this isn't actually a binary but a script which is running the actual whiptail binary + + + +We just need to specify the file name to read as the privesc is already included here + + + +