7

I am trying to do priviledge escalation of a linux box. My sudo -l output shows the following :

www-data@box:/scripts$ sudo -l
sudo -l
Matching Defaults entries for www-data on box:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User www-data may run the following commands on box:
    (scriptmanager : scriptmanager) NOPASSWD: ALL

What does the (scriptmanager : scriptmanager) mean?

And in one of the directories that I listed, it showed :

www-data@box:/scripts$ ls -l
ls -l
total 20
-rw-r--r-- 1 scriptmanager scriptmanager  88 Feb  8 09:11 dek.py
-rw-r--r-- 1 root          root            0 Feb  8 10:11 dik.py
-rw-r--r-- 1 www-data      www-data      129 Feb  8 09:25 mmm.py
-rw-r--r-- 1 scriptmanager scriptmanager  58 Dec  4 17:03 test.py
-rw-r--r-- 1 root          root           12 Feb  8 10:11 test.txt
-rw-r--r-- 1 www-data      www-data       85 Feb  8 10:08 tmp.py

Is there a way to priviledge escalate to a root shell? I have limited user shell without the password.

  • 2
    For those considering answering: this is a HackTheBox challenge, so information that leads Sankalp in the right direction rather than gives them the exact answer on a plate would probably be best! – Polynomial Feb 8 '18 at 18:16
  • Thanks @Polynomial: Thats why I tried changing the names where the box name was listed. – Sankalp Singha Feb 8 '18 at 18:23
2
(scriptmanager : scriptmanager) NOPASSWD: ALL

means that you can run any command as scriptmanager, and optionally set your group to scriptmanager when doing so. You won't need to provide a password when doing so. The scriptmanager user (or group) may or may not have the privileges you ultimately want.

  • Ok so basically I can chown a file or a folder to scriptmanager, however, that does not mean that I can run any command as the scriptmanager right? For that I would have to do something like su scriptmanager right? – Sankalp Singha Feb 8 '18 at 18:30
  • No, you can run any command as scriptmanager and do everything it can do. – forest Feb 9 '18 at 2:12
0

Try looking for files or executables that scriptmanager owns already that you can modify. Some of them may execute in a privileged context.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.