CHALLENGE INFORMATION
Platform: TryHackMe
Path: Complete Beginner
Module: Shells and Privilege Escalation
Room: Linux PrivEsc
Description: Practice your Linux Privilege Escalation skills on an intentionally misconfigured Debian VM with multiple ways to get root! SSH is available.
Deploy the Vulnerable Debian VM
Question 1: Deploy the machine and login to the user account using SSH.
No answer needed
Question 2: Run the ‘id’ command. What is the result?
uid=1000(user) gid=1000(user) groups=1000(user),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev)
Service Exploits
Question 1: Read and follow along with the above.
No answer needed
Weak File Permissions
Readable /etc/shadow
Question 1: What is the root user’s password hash?
$6$Tb/euwmK$OXA.dwMeOAcopwBl68boTG5zi65wIHsc84OWAIye5VITLLtVlaXvRDJXET..it8r.jbrlpfZeMdwD3B0fGxJI0
Question 2: What hashing algorithm was used to produce the root user’s password hash?
sha512crypt
Question 3: What is the root user’s password?
password123
Writable /etc/shadow
Question 1: Read and follow along with the above.
No answer needed
Writable /etc/passwd
Question 1: Run the ‘id’ command as the newroot user. What is the result?
uid=0(root) gid=0(root) groups=0(root)
Sudo
Shell Escape Sequences
Question 1: How many programs is user’allowed to run via sudo?
11
Question 2: One program on the list doesn’t have a shell escape sequence on GTFOBins. Which is it?
apache2
Question 3: Consider how you might use this program with sudo to gain root privileges without a shell escape sequence.
No answer needed
Environment Variables
Question 1: Read and follow along with the above.
No answer needed
Cron Jobs
File Permissions
Question 1: Read and follow along with the above.
No answer needed
PATH Environment Variable
Question 1: What is the value of the PATH variable in /etc/crontab?
/home/user:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
Wildcards
Question 1: Read and follow along with the above.
No answer needed
SUID/SGID Executables
Known Exploits
Question 1: Read and follow along with the above.
No answer needed
Shared Object Injection
Question 1: Read and follow along with the above.
No answer needed
Environment Variables
Question 1: Read and follow along with the above.
No answer needed
Abusing Shell Features - 1
Question 1: Read and follow along with the above.
No answer needed
Abusing Shell Features - 2
Question 1: Read and follow along with the above.
No answer needed
Passwords & Keys
History Files
Question 1: What is the full mysql command the user executed?
mysql -h somehost.local -uroot -ppassword123
Config Files
Question 1: What file did you find the root user’s credentials in?
/etc/openvpn/auth.txt
SSH Keys
Question 1: Read and follow along with the above.
No answer needed
NFS
Question 1: What is the name of the option that disables root squashing?
no_root_squash
Kernel Exploits
Question 1: Read and follow along with the above.
No answer needed
Privilege Escalation Scripts
Question 1: Experiment with all three tools, running them with different options. Do all of them identify the techniques used in this room?
No answer needed