---
description: Writeup for Sorcerer from offsec Proving Grounds
---

# Sorcerer

## Information Gathering

`sudo ./nmapAutomator.sh 192.168.197.100 all`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FXE91HenHDGbMVGTs9Jgl%2Fimage.png?alt=media\&token=9850d8e5-fbd4-4d46-9464-077938b86892)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FfIzHC3LUcttR2q0IM3Fy%2Fimage.png?alt=media\&token=7e91da46-3d4f-4fbf-a608-fdb3853c27eb)

### Service Enumeration

### HTTP (Port 80)

Dead end. Ran gobuster, nothing interesting came up.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FpBdzjNUf7F98T7AwwznU%2Fimage.png?alt=media\&token=5e99edb4-aaf3-4059-afdc-bc4ed157f165)

### HTTP (Port 8080)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FXCyc6S1WFS1yNaT7wz2q%2Fimage.png?alt=media\&token=ad70fa15-ca17-4613-b723-124a9b1e2bf6)

`gobuster dir -u http://192.168.197.100:8080/ -w /usr/share/dirb/wordlists/common.txt -t 40`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FYxW1FQfDVRilSqRc94At%2Fimage.png?alt=media\&token=a42ac6a1-2b9e-4c22-89fe-fb2ffba506a8)

Another dead end.

### HTTP (Port 7742)

Notice there are interesting files at `/default/` and `/zipfiles/`.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Flgd8r9F3WWnqirPiBh8e%2Fimage.png?alt=media\&token=386b5a01-3e99-4641-8ad2-3739e1d304bd)

## Exploit

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FXGHb9ughJOjpFr1GL9Qr%2Fimage.png?alt=media\&token=7c98dd25-9c55-45d6-8871-9604afed48e5)

We can download all the files and take a look at what's inside.

Using `ls -laR`, we can see that max has some interesting files.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F3CmkSWQfP4YomILnlmhR%2Fimage.png?alt=media\&token=c0bcd7a0-6406-4d02-a271-979afdc3fd9e)

Looking at the `authorized_keys` file, we can see that the file `scp_wrapper.sh` is called whenever a user connects with `ssh`.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FQ7UCWDxfClHpkWGGtGNF%2Fimage.png?alt=media\&token=877fcc89-a299-4b25-a6c2-e778e26807a3)

Let's take a look at this `scp_wrapper.sh`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FA9V5aCIw0bEV3eusR75n%2Fimage.png?alt=media\&token=591d1fdc-9328-4486-9e7f-b8284d76e587)

We can gather a few things from the script. When the user max connects to `ssh`, he can only execute commands that start with `scp`.

Since `scp` runs over `ssh`, we can use the `id_rsa` file from max to connect and overwrite the `scp_wrapper.sh` file with something to help us get an interactive shell.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fl8wlacMKm40e9XQKlmNw%2Fimage.png?alt=media\&token=1ebc41cd-e6da-4cc2-8665-a67d97b8b63a)

We can then edit the `scp_wrapper.sh` file to include the command 'bash'.&#x20;

We can now connect by SCP and transfer the edited wrapper file using the following command:

`scp -i /home/kali/PG/sorcerer/max-home/max/.ssh/id_rsa /home/kali/PG/sorcerer/max-home/max/scp_wrapper.sh max@192.168.197.100:/home/max/scp_wrapper.sh`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FOhxULb0Sa1SqBYZ3sJVZ%2Fimage.png?alt=media\&token=d2ae23a7-3404-42ed-b7f6-1699439a1d38)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FVnD30prVxJ1H2o1IefLr%2Fimage.png?alt=media\&token=50bb98c1-3d79-4b83-8590-e08b51df50a0)

We then found a dennis user and inside is local.txt.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FkfoRYcj0kH1GPSK6HHno%2Fimage.png?alt=media\&token=6a3ac04f-ad5e-49b9-a4c3-8289390d079b)

## Privesc

We can get `LinEnum.sh` on the machine after starting a python SimpleHTTPServer.

&#x20;

![Starting the SimpleHTTPServer on our attacking machine](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FU6M295HSoaUIqslXtMCh%2Fimage.png?alt=media\&token=c210079f-c498-4c9b-8db6-05ab99faf39a)

![Got our LinEnum.sh on the victim machine](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FAqKm2wfc0t1D2lcUhkiZ%2Fimage.png?alt=media\&token=e960f766-8447-4d64-96dc-1a7f8238087a)

LinEnum shows an interesting SUID file - start-stop-daemon.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FU8zbwDvpvij1gn8JYR0R%2Fimage.png?alt=media\&token=6674c119-3153-4a08-a181-ad1e24399ec5)

A quick search on GTFObins shows us the exact command to run to get root.

{% embed url="https://gtfobins.github.io/gtfobins/start-stop-daemon" %}

`/usr/sbin/start-stop-daemon -n $RANDOM -S -x /bin/sh -- -p`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fe1Wj6fxyELbFzb5xR9Ck%2Fimage.png?alt=media\&token=cf93aa15-c107-4b56-b009-cc9a637f1b14)
