Upon execution, the Python exploit instructs us to run two Netcat commands on another terminal. After executing each netcat command, we need to type "Y", to proceed further.

Run two NetCat commands on the terminal: 

Type "Y" to inject the remote code:

After trying to establish the remote login connection, it failed. This might be because the URL lacks any authentication token or additional credentials. 

However, there is an alternative format where you can directly include the username "admin" and password "dante1" in the URL itself, separated by a colon after "http://". This format is valid and will pass the provided credentials to the target server for authentication.

Type "Y" to inject the exploit:

Here, on this terminal, we have successfully connected to it. 

However, the remote connection doesn't seem to be stable, so run the Python command to spawn the terminal and use the below command to set the terminal type to xterm.

Even though we don't have a stable connection at the moment, we can still gather valuable information, which will help us in attempting an SSH connection . To do this, let's navigate to the " /home " directory and use the " ls " command to list the files and directories present. 

Among them, we notice a directory named "dante," which strongly suggests that it might be the username associated with the vulnerable server. This discovery can be crucial for further exploration and exploitation.

Now, let's carefully examine the files and directories to see if we can locate the password or any clues that the creator might have left behind. This information could be essential for advancing our exploration and gaining more access to the system.

Next, we'll navigate to the "dante" directory and use the " ls -al " command to list all files, including hidden ones, just like we do on any Linux platform. 

While exploring these directories, we came across an interesting file named " .download.dat ". To see its contents, we use the " cat " command. 

Decoding HEX-Encoded Text with CyberChef

Inside the file, we find HEX-encoded text , which could be a crucial piece of information for gaining access to the server. We'll copy this text and proceed to decode it using Cyberchef, a powerful tool for data manipulation and analysis .

To decode the HEX codes, we'll visit Cyberchef in our web browser. 

Firstly, we'll paste the HEX codes into the Input section and, in the Operation section, we'll search for " HEX " and then drag and drop the "FROM HEX" operation into the Recipe section. 

By checking the Output section, we successfully find the password for the user "dante".

With the valid username and its corresponding password, we are now equipped to gain access to the server using an SSH client tool.

Foothold

Since we have a valid username and password, let's establish a connection using an SSH client tool . Open a terminal and type "ssh" followed by the username and the host IP address. 

When prompted, enter the password to establish the connection.

The established connection has a stable connection, so let’s take a look at the user flag. 

Type the " ls " command to list the files and directories, and check if there is a user flag available or not. 

Here, we have the user flag on the “ local.txt ” file. Using the “ cat ” command take a look at its content.

Now, our main focus is to acquire the root flag. 

Upon navigating to the "/root" directory to obtain the root flag, we need root permission. It appears to be like that, we lack the necessary permissions to access the root directory. Therefore, let's proceed with Privilege Escalation to elevate our privileges and gain access to the root flag.

Privilege Escalation

During privilege escalation, the first step is to gather information about the system and identify potential vulnerabilities or misconfigurations that could allow us to elevate our privileges to gain access to the root level.

Firstly, Enumerate User Permissions to check, the user's privileges and rights on the system. This can be done by running commands like " sudo -l " or " id " to see what commands the current user can run with elevated privileges.

Let me run the “ id ” command to find out the user and group names , and numeric IDs like UID, or group ID of the current user or any other user on the server. 

Upon running the " id " command, we discovered that both the UID and group belong to the user "dante".

Let's check the rights and privileges of the current user by running the " sudo -l " command:

After executing the command, we discover that the user " dante " has sudo privileges specifically for the "tee" application.

tee privilege escalation

The " /usr/bin/tee " is a command-line tool used in Unix-like systems that allows users to read from one source ( like the keyboard or a file ), and then duplicate and send that input to both the screen ( standard output ) and one or more files. The name " tee " comes from its " T " shape, representing the splitting of the input into multiple streams.

In simple terms, when you use " tee " with a command or input, it shows the output on the screen as usual but also saves a copy of that output into specified files. This can be helpful when you want to keep a record of the output while still viewing it in real-time. It's commonly used in scripts and tasks where you need to capture and store data for later use.

After conducting a Google search for " tee privilege escalation ", we came across a helpful blog that explains two methods to use the " tee " command-line tool for privilege escalation.

Let's proceed step by step to achieve Privilege Escalation:

Method 1. Sudo Misconfiguration Exploiting Specific Binary

First, we will explore the options one by one. Our objective is to gain Privilege Escalation by utilizing the user's permissions in the sudoers file.

Here, is the following command:

Where, 

• The echo command is used to display the specified text on the terminal. Here, we are creating a new line in the sudoers file that grants specific privileges to the user "dante".
• The vertical bar symbol (|) is called a pipe. It is used to pass the output of the echo command as input to the next command, sudo tee.
• sudo tee -a "/etc/sudoers": The tee command is used to read from standard input and write to standard output and files simultaneously. 
• The -a option is used to append the input to the specified file rather than overwriting it.

When you run the entire command, it will add this line to the " /etc/sudoers " file, giving the user "dante" the ability to run any command with sudo privileges without being prompted for a password. However, it is essential to be cautious when modifying the " /etc/sudoers " file, as any mistakes could lead to system instability or security issues.

After successfully executing the command, you can verify the changes using the following command: ` sudo -l `. 

As you can see, the user " dante " now has root permission. 

Now that the user " dante " has root permission, let's access the root flag. To do this, change the current directory to the " /root " directory. 

However, you might encounter a " permission denied " error. To gain superuser permission, type ` sudo su `. 

Once you have gained superuser privileges , change the directory again, and now you can access the root directory. 

Let's check if there is a root flag file in the root directory by using the ‘ ls ’ command. 

Once you've located the root flag file, you can view its contents using the ` cat ` command.

Now, we have successfully gained the root flag.

Method 2. Adding a New User with Root Privileges

Let's explore the second method, which involves adding a new user to the target system: 

To do this, we'll use the openssl command line tool to generate an encrypted password for the new user.

1. First, we'll display the contents of the " /etc/passwd " file by typing " cat " followed by the file path. 

2. Next, we'll have to copy the structure of the "root" user and paste it into a text editor. Instead of "x" replace it with a dollar sign. Inside the brackets, we'll use the " openssl passwd -6 -salt <user_name> <password> "

Where, 

1. The "-6" flag indicates an SHA-512 hash
2. The "-salt" flag adds salt to the hash for security
3. Instead of " root ," we'll use the new username for the user that we want to create. 

After that, we'll add the " tee " command to save the changes to the " /etc/passwd " file:

Finally, we'll copy the newly generated command, and paste the entire command into the terminal to add the new user.

Now, we can switch to the newly created user by running the " su " command:

As you can see we have successfully gained root privilege.

If you have any questions or doubts, feel free to leave a comment in the comment section below. I'll be happy to help and address any inquiries you may have.