> For the complete documentation index, see [llms.txt](https://thamizhiniyancs.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thamizhiniyancs.gitbook.io/writeups/tryhackme/machines/easy/capstone-challenge.md).

# Capstone Challenge

TryHackme Capstone Challenge writeup by Thamizhiniyan C S

## Overview

Greetings everyone,

This write-up is a walk-through of the Capstone Challenge, which is the final task of the TryHackMe room Linux Privilege Escalation.

Machine link: [Linux Privilege Escalation](https://tryhackme.com/room/linprivesc)

Difficulty Level: Easy

Let's Begin 🙌

Firstly, connect to the THM server using the OpenVPN configuration file generated by THM. [Click Here](https://tryhackme.com/r/access) to learn more about how to connect to VPN and access the boxes.

Once connected to the VPN service, click on "Start Machine" to access the machine's IP.

Upon joining the machine, you will be able to view the IP address of the target machine.

***

First start the machine and login via SSH with the given credentials.

Username: `leonard`

Password: `Penny123`

Command: `ssh leonard@<Target_IP>`

Now I started to look out for the privilege escalation vectors.

I was looking out for files with SUID permissions with the following command:

`find / -type f -perm -04000 2>/dev/null` and found that the `/usr/bin/base64` file has SUID permission.

<figure><img src="https://3987209575-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCrNVqJHUzhf98WDK3DMl%2Fuploads%2F6opamnJ2i1EvHjxUwH7d%2FUntitled.png?alt=media&amp;token=ff229611-abfb-4197-8fd8-fc4d26658024" alt=""><figcaption></figcaption></figure>

So I checked <https://gtfobins.github.io/gtfobins/base64/>, looking out for SUID privesc and got the following:

<figure><img src="https://3987209575-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCrNVqJHUzhf98WDK3DMl%2Fuploads%2F2l1OIr0s7gVR9lIyhE28%2FUntitled%201.png?alt=media&amp;token=08a173e1-4625-4090-a349-dec5ced7180d" alt=""><figcaption></figcaption></figure>

I tried the first command `sudo insall -m =xs $(which base64)` , but it didn’t work.

<figure><img src="https://3987209575-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCrNVqJHUzhf98WDK3DMl%2Fuploads%2FN5AkJOOjFkyRx1NxQjtn%2FUntitled%202.png?alt=media&amp;token=4c2bd4f5-d1d0-48d3-9e76-970fed099e8a" alt=""><figcaption></figcaption></figure>

Next I tried the following command:

`base64 /etc/shadow | base64 --decode`

<figure><img src="https://3987209575-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCrNVqJHUzhf98WDK3DMl%2Fuploads%2FEjpidvu5MZaI6iaJRRzA%2FUntitled%203.png?alt=media&amp;token=acbff302-3f23-4b5a-a20f-15952789f1a0" alt=""><figcaption></figcaption></figure>

And got the contents of the `/etc/shadow` file.

Now I tried to crack the password hash of the user `missy` using `johntheripper`. I copied the hash and put that In a `hash.txt` file.

<figure><img src="https://3987209575-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCrNVqJHUzhf98WDK3DMl%2Fuploads%2FAbLHFy8TsnBkCc8chuG4%2FUntitled%204.png?alt=media&amp;token=65cb5d1f-5aa6-4ff6-ad20-97c324d314a2" alt=""><figcaption></figcaption></figure>

Now I used `john` to crack the hash.

Command: `john --wordlist=/usr/share/wordlists/rockyou.txt ~/Desktop/hash.txt`

<figure><img src="https://3987209575-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCrNVqJHUzhf98WDK3DMl%2Fuploads%2F97dAH1HuaIlWj99eLo68%2FUntitled%205.png?alt=media&amp;token=dd5dd58a-ab22-430d-88f4-9cfce8d1aa2a" alt=""><figcaption></figcaption></figure>

And we got the password for the user `missy`. Now using the credentials, login as the user missy using the following command `su missy`.

<figure><img src="https://3987209575-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCrNVqJHUzhf98WDK3DMl%2Fuploads%2FXZrHeYoCEkuwzeDnmZVz%2FUntitled%206.png?alt=media&amp;token=66867687-21a2-42e1-a9a5-4f3578e62040" alt=""><figcaption></figcaption></figure>

Now we have logged in as the user `missy` . Now I searched for the `flag1.txt` file using the find command: `find / -name flag1.txt 2>/dev/null`

<figure><img src="https://3987209575-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCrNVqJHUzhf98WDK3DMl%2Fuploads%2F4bIbDFU4zmNBXXC2GBLc%2FUntitled%207.png?alt=media&amp;token=4e3577fb-f72a-4781-a0a0-af07d0b5aef2" alt=""><figcaption></figcaption></figure>

and found the flag at `/home/missy/Documents/flag1.txt`.

<figure><img src="https://3987209575-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCrNVqJHUzhf98WDK3DMl%2Fuploads%2F6r9bKhyNA4A2kswCyJp3%2FUntitled%208.png?alt=media&amp;token=dce414eb-a6a2-421f-8d6c-bb5c15a6181a" alt=""><figcaption></figcaption></figure>

Next we have to find the root flag. Again I started looking out for privilege escalation vectors.

I checked the commands that the user `missy` can run with root privileges using the following command: `sudo -l`

<figure><img src="https://3987209575-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCrNVqJHUzhf98WDK3DMl%2Fuploads%2FjK32PvBUjw5achW19iD9%2FUntitled%209.png?alt=media&amp;token=053b9294-a9ca-46b3-866e-2a0068c5d9ef" alt=""><figcaption></figcaption></figure>

And found that the user `missy` can run the find command with root privileges. So, again looking for ways to escalate privilege at <https://gtfobins.github.io/gtfobins/find/> , found the following:

<figure><img src="https://3987209575-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCrNVqJHUzhf98WDK3DMl%2Fuploads%2FOfWfawtuQfl3dNnIwnfr%2FUntitled%2010.png?alt=media&amp;token=6368d06e-430b-4ce3-837b-9f3bed7658ce" alt=""><figcaption></figcaption></figure>

I tried the above command and got a shell with root privilege.

<figure><img src="https://3987209575-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCrNVqJHUzhf98WDK3DMl%2Fuploads%2FVheZZPmnilrUUrWtwgyW%2FUntitled%2011.png?alt=media&amp;token=ade64ac8-e9c0-4763-b733-40152a6b98e8" alt=""><figcaption></figcaption></figure>

This time I used the find command to search the flag2.txt file.

Command: `find / -name flag2.txt 2>/dev/null`

And found the file at `/home/rootflag/flag2.txt`

<figure><img src="https://3987209575-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCrNVqJHUzhf98WDK3DMl%2Fuploads%2F607Vj4WPP1nGA7jXBLfp%2FUntitled%2012.png?alt=media&amp;token=f0a9d87f-d04d-45cd-a8ea-0dd77efae8c5" alt=""><figcaption></figcaption></figure>

And finally we got the root flag.

Thank you ….. See you guys with another awesome writeup….