Eavesdropper - CTF Write-Up - TryHackme
Listen closely and you might hear a password!
Last updated
Was this helpful?
Listen closely and you might hear a password!
Last updated
Was this helpful?
As the room's title suggests, our objective is to eavesdrop in order to obtain the password. I've explored various common enumeration methods within this room, testing different ways to exploit it—while some approaches showed promise, most did not yield the desired results.
To keep this write-up concise, let's dive right in. Our initial step involves checking for running processes.
Upon examining the situation, it becomes evident that there's another SSH process running with elevated privileges. To monitor this process discreetly, we will employ the 'pspy' tool. Follow these steps:
Once downloaded, proceed to deploy the tool for further investigation.
While monitoring the processes, focus on those with the UID=0, as they are typically root processes. Look for any relevant details in these processes.
sudo cat /etc/shadow
To obtain the password, we must hijack the process. It's worth noting that "sudo" is being called via a relative path.
By altering the value in the path variable and creating our own "sudo" command, we can hijack the process. Let's proceed with the coding steps.
Now provide executable permission
Finally change the PATH variable inside .bashrc file in /home/frank, one thing to note is that you need to enter this path as the first line in .bashrc file
Log out of the current SSH session.
Log back in; you should now have the password.
Once logged in, comment out the PATH variable from the bashrc file.
Log out again.
Log back in to obtain a root shell.
Provide the password, and you will have the root shell.
Download the 'pspy' tool from the following link: .
I hope you had fun, learning new stuff
