All Posts

Apache misconfiguration that allowed me to gain foothold by bypassing a MIME upload, then I executed RCE to shell. For root, there was a changename.sh file which cleaned up the uploads directory, but I changed it to give root.

Exploited tcpdump, privesc'd with openssl from the e= capability.

First exploited VSFTP, which returned a shell through Psy Shell, then we sign a client certificate to authenticate ourselves. Now, we exploit directory traversal to gain an ssh key. For root, we notice a process executing frequently, so we use that functionality to route to a reverse shell that gives me root access.

Funny box, met with a lot of memes which indicated I was getting closer or further from the objective, enumerating SMB & DNS, to then exploit LFI and privesc with python.

Started by exploiting an IRC server, which lead to enumerating and finding a vulnerable service, gaining foothold, and then privescing with SUID.