Capstone Challenge

TryHackme Capstone Challenge writeup by Thamizhiniyan C S

Overview

Greetings everyone,

This write-up is a walk-through of the Capstone Challenge, which is the final task of the TryHackMe room Linux Privilege Escalation.

Machine link: Linux Privilege Escalation

Difficulty Level: Easy

Let's Begin 🙌

Firstly, connect to the THM server using the OpenVPN configuration file generated by THM. Click Here to learn more about how to connect to VPN and access the boxes.

Once connected to the VPN service, click on "Start Machine" to access the machine's IP.

Upon joining the machine, you will be able to view the IP address of the target machine.

---

First start the machine and login via SSH with the given credentials.

Username: leonard

Password: Penny123

Command: ssh leonard@<Target_IP>

Now I started to look out for the privilege escalation vectors.

I was looking out for files with SUID permissions with the following command:

find / -type f -perm -04000 2>/dev/null and found that the /usr/bin/base64 file has SUID permission.

So I checked https://gtfobins.github.io/gtfobins/base64/, looking out for SUID privesc and got the following:

I tried the first command sudo insall -m =xs $(which base64) , but it didn’t work.

Next I tried the following command:

base64 /etc/shadow | base64 --decode

And got the contents of the /etc/shadow file.

Now I tried to crack the password hash of the user missy using johntheripper. I copied the hash and put that In a hash.txt file.

Now I used john to crack the hash.

Command: john --wordlist=/usr/share/wordlists/rockyou.txt ~/Desktop/hash.txt

And we got the password for the user missy. Now using the credentials, login as the user missy using the following command su missy.

Now we have logged in as the user missy . Now I searched for the flag1.txt file using the find command: find / -name flag1.txt 2>/dev/null

and found the flag at /home/missy/Documents/flag1.txt.

Next we have to find the root flag. Again I started looking out for privilege escalation vectors.

I checked the commands that the user missy can run with root privileges using the following command: sudo -l

And found that the user missy can run the find command with root privileges. So, again looking for ways to escalate privilege at https://gtfobins.github.io/gtfobins/find/ , found the following:

I tried the above command and got a shell with root privilege.

This time I used the find command to search the flag2.txt file.

Command: find / -name flag2.txt 2>/dev/null

And found the file at /home/rootflag/flag2.txt

And finally we got the root flag.

Thank you ….. See you guys with another awesome writeup….