Potato-1

By Lawcky 09/01/24

Introduction

Boot to Root

Difficulty : easy

Additionnal info :

Name: Potato: 1
Release date: 2 Aug 2020
Author: Florianges
Series: Potato

|NOTE| if you want to see all the scans we wont copy them here as they would be way too voluminous, click here to see them

---

In this write-up

• php comparator bypass
• LFI
• Hashcat

---

Write-UP

Login page

we found a login page with what seems to be a php comparator or a sqli

we capture the paquet and transform the password variable to password[]

now the php compares an array to a string and will return a NULL value (php documentation), which will accept the login.

---

LFI

we now have access to the dashboard, we catch the paquet that calls on the logs.txt files to try for an LFI of the /etc/passwd file

hashcat -m 500 hash ~/tools/seclist/rockyou.txt

TGUgY29udHLDtGxlIGVzdCDDoCBwZXUgcHLDqHMgYXVzc2kgcsOpZWwgcXXigJl1bmUg first flag found

Privilege Escalation

nice is a special bin that basically execute a sh file.

we can try to bypass this by basically using the /notes directory (in which we dont have write permission) and getting out onto another directory like this :

sudo /bin/nice /notes/../tmp/test

with “test” beeing a file i created with /bin/bash inside

bGljb3JuZSB1bmlqYW1iaXN0ZSBxdWkgZnVpdCBhdSBib3V0IGTigJl1biBkb3VibGUgYXJjLWVuLWNpZWwuIA==

second flag found