🕵️Eavesdropper - CTF Write-Up - TryHackme
Listen closely and you might hear a password!
Last updated
Listen closely and you might hear a password!
Last updated
As the room's title suggests, our objective is to eavesdrop in order to obtain the password. I've explored various common enumeration methods within this room, testing different ways to exploit it—while some approaches showed promise, most did not yield the desired results.
To keep this write-up concise, let's dive right in. Our initial step involves checking for running processes.
Upon examining the situation, it becomes evident that there's another SSH process running with elevated privileges. To monitor this process discreetly, we will employ the 'pspy' tool. Follow these steps:
Download the 'pspy' tool from the following link: Releases · DominicBreuker/pspy.
Once downloaded, proceed to deploy the tool for further investigation.
While monitoring the processes, focus on those with the UID=0, as they are typically root processes. Look for any relevant details in these processes.
sudo cat /etc/shadow
To obtain the password, we must hijack the process. It's worth noting that "sudo" is being called via a relative path.
By altering the value in the path variable and creating our own "sudo" command, we can hijack the process. Let's proceed with the coding steps.
Now provide executable permission
Finally change the PATH variable inside .bashrc file in /home/frank, one thing to note is that you need to enter this path as the first line in .bashrc file
Log out of the current SSH session.
Log back in; you should now have the password.
Once logged in, comment out the PATH variable from the bashrc file.
Log out again.
Log back in to obtain a root shell.
Provide the password, and you will have the root shell.
| Table of Contents |
|---|
I hope you had fun, learning new stuff
