---
description: https://tryhackme.com/room/vulnnetendgame
---

# VulnNet: Endgame

## <img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2F4MZttXZdEhrB2Hgb8smU%2Fimage.png?alt=media&#x26;token=2a5035c0-9ea1-42ca-9649-111007d632c9" alt="" data-size="line"> VULNNET WRITEUP

_By Jacvbtaylor_



```
       Used openvpn and Kali Linux 
                 https://tryhackme.com/room/vulnnetendgame
         completed Sep 20, 2022
```

For this challenge, the goal is to find the administrator's password of the CMS along with the user and root flag.&#x20;

### STEP 1: Recon

Starting with a scan using [https://github.com/jacvbtaylor/nmapscript](https://github.com/jacvbtaylor/nmapscript), I can see the following services running:\
\
`22/tcp open ssh` \
`80/tcp open http`

Knowing there is a webserver running, I pulled up the webpage using the IP address provided and was prompted with the following HTML text:

_**Our services are accessible only through the vulnnet.thm domain!**_

I decided to try adding this to my host file to see how this would possibly change the webpage and was served a new webpage

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2F78IEwdrfAPRwqxXXHCYY%2Fimage.png?alt=media&#x26;token=832a9597-5658-4345-ba56-007415dc0c5f" alt=""><figcaption><p>vulnet.thm</p></figcaption></figure>

Viewing the page source first, I found some directories insides the vulnnet webfolder such as /js/.\
I figured this was a good time to start searching for folders that are not indexed or may be hidden so I cracked open dirb and gobuster:\
\
`dirb http://vulnnet.thm`\
\
`gobuster dir -u http://vulnnet.thm -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt`

I noticed some basic names coming back positive but found these to be indexed with

```
<title>Silence is Eloquence</title>
```

The images folder had no index but held nothing noticeably useful. Below are the folders that I found using multiple tools and wordlists, all leading to a dead end.&#x20;

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FZHw1EhXSw32CAxYcK1jO%2Fimage.png?alt=media&#x26;token=e727ee99-ddea-4c6e-b7be-ee62b4e87ece" alt=""><figcaption><p>gobuster</p></figcaption></figure>

I was unable to locate anything within the vulnnet domain that would direct me to a CMS, so my next thought was to search for possible subdomains. Something  commonly done when trying to be more discreet and/or secure with your webpage is move important information in front of the domain. \
\
&#xNAN;_**EX**_: if you are hosting a wordpress site, the wp-config file is commonly sought after because of it's critical information inside. Moving that file from var/www/html to /var/www would keep the site functioning but would not grant public access to the wp-config.php file. The same concept can be used for a test or develop site making it only accessible using the www subdomain or similarly, another folder created for those files. \
\
I tried a few various of tools and options within them to find subdomains with no real luck and a lot of crashing my kali machine using up too much ram.  Here are a couple of examples of what did not work for me:&#x20;

`gobuster dns -d vulnnet.thm -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt`

`wfuzz -c -v -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt --sc 200,202,204,301,302,307,403 -u http://vulnnet.thm -H "Host:FUZZ.vulnnet.thm"`



### STEP 2: Subdomains

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FLvxGUb55CKfDL66rRxHi%2Fimage.png?alt=media&#x26;token=640cd101-0dd2-4881-b5fe-2feb35123539" alt=""><figcaption><p>subdomains</p></figcaption></figure>

After bumping up my VM's ram and CPU, I looked toward other options. This was my first time using the ffuf tool. Initially, too much information was being spat out with a status 200 but they all had the same word count of 9. You can see from the image above that those results all have different word integers. So in order to get the appropriate results, the command had to have the `-fw 9` option on the end&#x20;

`ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://vulnnet.thm -H "Host: FUZZ.vulnnet.thm" -fw 9`

The ffuf scan gathered those 4 domains fairly quickly, but I let it continue to run while I scoped out these subdomains, in the event it may capture more.&#x20;

In order for me to be able to visit these additions, I need to add them to my /hosts/ file

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FdEXPyHU4E2FyYfUSHM52%2Fimage.png?alt=media&#x26;token=57bf15aa-a520-439e-b565-e46719335d7d" alt=""><figcaption><p>/etc/hosts</p></figcaption></figure>

I visited each of these subdomains and was able to find more areas to explore, but to broaden this further, I initiated a dirb attack on the domains. I saw in the source code for blog.vulnnet a clue to the CMS being used when I saw `Mediumish Theme.` This is a Wordpress theme, so PHP may be my main focus here, or at least incorporated into the attack.



Dirb was able to pull some new information for me- some highlights being a fileadmin directory and a login page. The fileadmin directory shows a folder called user\_upload. I may be able to use this if I find a way to upload to this directory.&#x20;

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2F1imbwFG8RcMb0wLmFPlC%2Fimage.png?alt=media&#x26;token=01e261e2-3dc6-42f6-8225-27636e646a78" alt=""><figcaption><p>fileadmin</p></figcaption></figure>

The login form for typo3 initiates on index.php, but reacts differently than any other login page I've used.&#x20;

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FZBkBaX4NvVtPYZql8Q8p%2Fimage.png?alt=media&#x26;token=887d14cc-bb35-4b4a-95ed-164ab70f34a1" alt=""><figcaption><p>typo3</p></figcaption></figure>

I intercepted my post request using burp to see how the request looked so I could create a payload with hydra to attempt a bruteforce\
\
`hydra -L /usr/share/wordlists/usernames.txt -P /usr/share/wordlists/rockyou.txt admin1.vulnnet.thm http-post-form "/typo3/?loginProvider=1433416747:login_status=login&userident=^PASS^=&interface=backend&username=^USER^&p_field=&commandLI=:Your login attempt did not succeed Make sure to spell your username and password correctly, including upper/lowercase characters." -vV -t 60 -F`

All of my attempts to bruteforce the login ended with the username 3d and a different password each time. I was getting false positives. I realized this wasn't going to work. Either my syntax wasn't appropriate for the request or there was some line of defense set up against bruteforcing, so I had to turn toward other means.&#x20;

### STEP 3: PHP & JSON&#x20;

I retreated to the blog subdomain. I noticed some of the files on the blog page used html but the posts used php extensions. This felt important to investigate since the API was also using php:&#x20;

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FeInCrqzgpLfc6RYEUQRr%2Fimage.png?alt=media&#x26;token=1587a455-1e76-405d-bd2a-c16647dc935c" alt=""><figcaption><p>api php</p></figcaption></figure>

All of the post().php files seemed to have the same script implemented in them which can be seen on line 305

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FQQH33NYpnLNtCdvZaqRo%2Fimage.png?alt=media&#x26;token=53a3ca9a-5b06-4f24-8bbc-e5aa38598d02" alt=""><figcaption><p>script</p></figcaption></figure>

When I call that file in the browser I am presented with this:

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FlS4Sns5PMYWOY2U8z3ml%2Fimage.png?alt=media&#x26;token=4b0f6906-2979-4190-8a9d-a19982a37d52" alt=""><figcaption><p>JSON</p></figcaption></figure>

I began messing with the parameters in the URL and was getting new results, but I wasn't sure how to truly exploit this yet

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FdJFEfUoND8QjomaJTDWW%2Fimage.png?alt=media&#x26;token=f2f1304c-35f2-4255-bcce-8cdf6a6ce449" alt=""><figcaption><p>jacvb = jacvb</p></figcaption></figure>

The fastest way to kickstart this URL exploitation was to use a tool called SQLmap.&#x20;

`sqlmap -u http://api.vulnnet.thm/vn_internals/api/v2/fetch/?blog=1`

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2Fs9E1ttwOinbl6TJQ2ut8%2Fimage.png?alt=media&#x26;token=1568df4b-84f1-47a2-bea2-a9ad8dd5d5ec" alt=""><figcaption><p>sqlmap</p></figcaption></figure>

This is good news! I ran the command again, but this time with the -dbs option at the end and was informed about 3 databases:

`[`_`*`_`] blog` \
`[`_`*`_`] information_schema` \
`[*] vn_admin`

### STEP 4: Database

Using SQLmap again, I dumped the tables and columns \
`sqlmap -u http://api.vulnnet.thm/vn_internals/api/v2/fetch/?blog=1 -dbs --tables --columns`

Focusing first on the blog database, we discover a users table with 3 columns: id, username, and password.&#x20;

`sqlmap -u http://api.vulnnet.thm/vn_internals/api/v2/fetch/?blog=1 --dump -T users -D blog`&#x20;

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2F54CeTYEtDvm7WzNYtUzW%2Fimage.png?alt=media&#x26;token=c78d4a72-af23-489e-8748-d8c07f240a62" alt=""><figcaption><p>blog users</p></figcaption></figure>

Dumping the users table gave us 651 usernames and passwords. I sorted this into a file that I could maybe use for later:

`cat /root/.local/share/sqlmap/output/api.vulnnet.thm/dump/blog/users.csv | sed -e 's/,/ /g' | awk '{print$3,$2}' > bloguserpass`

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2F0pUPK56sLRdAkmi6q5e4%2Fimage.png?alt=media&#x26;token=96d0f956-7888-431b-90e0-b077302775d5" alt=""><figcaption><p>blog username pass</p></figcaption></figure>

I got rid of the id number and moved the usernames to the left of the password. I can easily separate the 2 columns now if I need to make a list for bruteforcing. &#x20;



After exploring the vn\_admin database, I found a user from the be\_users table and password/username columns. Hopefully this is the user for the typo login!\


<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FiqRkjk7WNbngDghW0Ynp%2Fimage.png?alt=media&#x26;token=b549e21c-96bb-4e42-bb79-2b372fc49f13" alt=""><figcaption><p>chris pass</p></figcaption></figure>

I put the user and hash into a file and started john the ripper to try and crack this hash. This was my first time encountering argon, so I was putting a lot of faith into john.  While that ran, I grabbed the passwords from the blog database so I could try and crack the password with that as well if I was unable to get in with hydra

`cat bloguserpass | awk '{print$2}' > passwords`

`hydra -l chris_w -P THM/VulnnetEG/passwords admin1.vulnnet.thm http-post-form "/typo3/?loginProvider=1433416747:login_status=login&userident=^PASS^&username=^USER^:Your login attempt did not succeed Make sure to spell your username and password correctly, including upper/lowercase characters." -vV -t 60 -F`

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2Fbwl3BahyhWwf3A6uhUfG%2Fimage.png?alt=media&#x26;token=a69929a3-496e-48ab-b25b-2e314b299667" alt=""><figcaption><p>false positive</p></figcaption></figure>

Another false positive. I was hoping this smaller password list would help us get in, but back to john:&#x20;

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2Fl2s69K6tcVqXveaW1hnf%2Fimage.png?alt=media&#x26;token=93b1a4d6-0651-4422-ad80-7f11d42c6936" alt=""><figcaption><p>john the ripper</p></figcaption></figure>

### STEP 5: Typo3

Using that username and password, I was granted access to the typo dashboard. Remembering that user\_upload folder I found earlier, I figured now would be a good chance to utilize that to gain access to the server.&#x20;

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FjK3pcyF9ibmVWV1oZZgB%2Fimage.png?alt=media&#x26;token=7d0e218e-c26d-42e8-9a45-ad69f6ac3a08" alt=""><figcaption><p>php not allowed</p></figcaption></figure>

I figured this was going to work with no issue, but found that php wasn't allowed into these directories. This rule would either be set in an .htaccess file or some configuration control may be available inside this dashboard.&#x20;

After looking through some tabs in the admin tools and the settings, I came across \
`"Configure Installation-Wide Options`\
`Global Configuration`\
`Modify settings written to LocalConfiguration.php."`

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FPRDgLxoRFXst1qwpbRUK%2Fimage.png?alt=media&#x26;token=969148d8-47e5-4c3c-a2fb-3e27baa6e09d" alt=""><figcaption><p>filedeny</p></figcaption></figure>

It looks like I was write about the rule being the .htaccess file. I don't think anyone will be upset if I delete this rule.  Now I just need to upload and visit my new webshell.

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FDprihngG7rqethCFI3tX%2Fimage.png?alt=media&#x26;token=48589c4d-f73b-4d09-8b79-237291b8d70e" alt=""><figcaption><p>webshell</p></figcaption></figure>

There's a good chance this is where our user flag is placed, but we don't have permission to open it. I noticed this file is in system's home directory, and I saw system has bash from viewing the /etc/passwd file. This is probably my next move, becoming the system user.&#x20;

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FWuQ4TocTXu5fuCuuksrg%2Fimage.png?alt=media&#x26;token=60106634-6f23-4c6e-b68e-eec17d4da28f" alt=""><figcaption><p>user.txt</p></figcaption></figure>

My next idea is to gain shell access, and possibly escalate my user from there. Since I already uploaded one php file, I can go through the same step to upload a reverse shell and start netcat to listen in on the call home and I am in:

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FvJ11j7cXUhKQ86noKy8O%2Fimage.png?alt=media&#x26;token=5e39cccf-b6b5-4b12-9607-487d291535db" alt=""><figcaption><p>shell</p></figcaption></figure>

### STEP 6: User Privilege&#x20;

From the reverse shell, I should be able to accomplish a bit more than I could with the web shell. My user, www-data, doesn't belong to any special groups and probably has no sudo privileges, so I want to see if I can find more information about the system user. &#x20;

\
`cd /home/system && ls -a`

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2Fd3OGECAONqBsRWvQf7y4%2Fimage.png?alt=media&#x26;token=9f74d386-c473-44ef-8e07-9411fa10d492" alt=""><figcaption><p>ls -a</p></figcaption></figure>

There are a few files I now see that I may be able to check out, assuming I have access to them.&#x20;

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2F2SqspVfYRhKqU911GvbG%2Fimage.png?alt=media&#x26;token=ff4afe35-33ee-4867-b79b-b3acbd9b45f9" alt=""><figcaption><p>firefox</p></figcaption></figure>

After some snooping around in this folder, my initial thought was to copy this browser information to a public folder, but my user did not have permission\
\
`cp -r /home/system/.mozilla/firefox/8mk7ix79.default-release /var/www/admin1/fileadmin/user_upload`

_**"cp: cannot open '/home/system/.mozilla/firefox/8mk7ix79.default-release/saved-telemetry-pings/49e0d2f0-9780-4e75-b40e-ae927de3bdcf' for reading: Permission denied"**_

I was having issues zipping the information as well.

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2Fu70Foe2jRN2qrn8lWVgm%2Fimage.png?alt=media&#x26;token=282797e1-8bc2-45c1-b8ab-3fb8f3290b52" alt=""><figcaption><p><em><strong>zip</strong></em></p></figcaption></figure>

This is when I realized I need to find a directory my user could tamper with, not just navigate through and read inside of: _/tmp/_

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FcsqsGqkhEd8F1L41cHuz%2Fimage.png?alt=media&#x26;token=9ac7dfdf-bf6a-4ec9-93ad-d186d85cb5eb" alt=""><figcaption><p><em>/tmp/</em></p></figcaption></figure>

This worked! I am hoping there may be some cached information in this zip file from the system user, but there's only one way to find that out. From the /tmp/ folder I was able to move the zip to the /fileadmin/ folder and download it to my machine. Perfect.

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FFyLL32mqsmpE8L00ZCZf%2Fimage.png?alt=media&#x26;token=15472604-a35c-4de4-89a0-884d5f35f79c" alt=""><figcaption><p>firefox</p></figcaption></figure>

After browsing through the default-release files, I found one of them had a login file which hosted an encrypted username and password. I searched "firefox decrypt" and came across this neat tool python tool by [https://github.com/unode](https://github.com/unode).&#x20;

Never using this tool before, I had to tinker with it a bit and came across a problem&#x20;

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2Ft5T2X1N9cwM2dvWe3vn2%2Fimage.png?alt=media&#x26;token=57d34187-8642-4df0-92ce-cada63a2283d" alt=""><figcaption><p>decrypt</p></figcaption></figure>

I need a way to point this tool to the login file I found.  I first tried copying the login file to the 8mk directory, but it didn't like that

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2Fw0QtZqH4vgolXA1tpqLL%2Fimage.png?alt=media&#x26;token=63500e5c-3da2-4e74-9ea2-a75cd20e5668" alt=""><figcaption><p>login fail</p></figcaption></figure>

When I tried running the tool directly on the login.json file, I got a warning that profile.ini was not found. I found that file in the firefox directory and added a new profile to it

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FVVBlUvUz2yy9hqIumWIY%2Fimage.png?alt=media&#x26;token=db0508d1-9933-44ec-894d-bdf053c747da" alt=""><figcaption><p>profile.ini</p></figcaption></figure>

then ran the tool one more time after making sure each profile had a unique profile number and got the information I was after

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FCB4vwyP2EMHgbVeQ3Yn9%2Fimage.png?alt=media&#x26;token=ba5b9460-532a-4f31-8c4f-612f547c2538" alt=""><figcaption><p>firefox decrypt</p></figcaption></figure>

### STEP 7: System User to Root

I used that password to ssh into the server as the system user. Now I can get the flag&#x20;

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FvWpFyEwXjD9PkIDKOSb3%2Fimage.png?alt=media&#x26;token=6913e00a-1411-4379-8e82-6b5137e99096" alt=""><figcaption><p>user</p></figcaption></figure>

I explored my new home directory and saw a folder name that seemed unusual. The Utils folder seemingly had a few different tools inside of it. I discovered they were all dynamically linked ELF files.  The last time I dealt with and ELF file, I was able to spawn a shell. To figure that out, I had to learn about the getcap command. You can see what I did [here](https://jacob-taylor.gitbook.io/tryhackme-writeup/v/wonderland/) when I first encountered a similar situation. So to begin, I decided to take a similar approach and see what capabilities these files may have. This seemed to work perfectly.

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FNi8ERe9XKA0QbyhyinLJ%2Fimage.png?alt=media&#x26;token=8e00921f-5110-4fb6-98b5-4d922551dd45" alt=""><figcaption><p>=ep</p></figcaption></figure>

Referencing this webpage [here ](https://unix.stackexchange.com/questions/515881/what-does-the-ep-capability-mean)I see that =ep means all capabilities are effective and permitted. This sounds cool but I still don't know what to do about it yet. GTFObins seems to always have the answers so I search "[_gtfobins openssl_](https://gtfobins.github.io/gtfobins/openssl/)".&#x20;

Worked like a charm:\
`HACK=/etc/sudoers && echo "system ALL=(ALL) NOPASSWD:ALL" | ./openssl enc -out "$HACK"`

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FqYKvtGJpq7ZXoI8nzPjV%2Fimage.png?alt=media&#x26;token=9a3fc882-8210-46bf-a2c1-d7cdbebe4bc5" alt=""><figcaption><p>root</p></figcaption></figure>

Using the capabilities of the openssl file, I was able to make a privileged write to the /etc/sudoers file and give the system user sudo privileges and move to the root user, gaining full access to the server. &#x20;

<figure><img src="https://2462827584-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fct013LbdcmwFVKptkkUy%2Fuploads%2FS75zxiITUXvIlsfw35yt%2Fimage.png?alt=media&#x26;token=15142d46-61bd-44eb-bc9f-e21653d191c4" alt=""><figcaption></figcaption></figure>
