From 9255a4198d632193477af61e0ecd25e7a28f3fbd Mon Sep 17 00:00:00 2001
From: ARZ <60057481+AbdullahRizwan101@users.noreply.github.com>
Date: Sat, 4 Dec 2021 19:25:52 +0500
Subject: [PATCH] Create cretin.md
---
echoCTF/cretin.md | 42 ++++++++++++++++++++++++++++++++++++++++++
1 file changed, 42 insertions(+)
create mode 100644 echoCTF/cretin.md
diff --git a/echoCTF/cretin.md b/echoCTF/cretin.md
new file mode 100644
index 0000000..666f2d2
--- /dev/null
+++ b/echoCTF/cretin.md
@@ -0,0 +1,42 @@
+# echoCTF - Cretin
+
+We can find the first flag by printing the environmental variable `env`after connecting with `nc`
+
+
+
+## Privilege Escalation (dribble)
+
+Running `sudo -l` we can see that this user can run`ed` binary as `dribble` user
+
+
+
+So looking at GTFOBINS
+
+
+
+
+
+## Privilege Escalation (scribble)
+Again running sudo -l we can see this user can now run `capsh` binary as `scribble` user
+
+
+
+
+
+## Privilege Escalation (ETSCTF)
+
+This is the last priv esc that we need to do , we can run `whiptail` as `ETSCTF` user
+
+
+
+
+
+Running that we will get ambiguous redirect , so this isn't actually a binary but a script which is running the actual whiptail binary
+
+
+
+We just need to specify the file name to read as the privesc is already included here
+
+
+
+