10

I am trying to do priviledge escalation of a linux box. My sudo -l output shows the following :

www-data@box:/scripts$ sudo -l
sudo -l
Matching Defaults entries for www-data on box:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User www-data may run the following commands on box:
    (scriptmanager : scriptmanager) NOPASSWD: ALL

What does the (scriptmanager : scriptmanager) mean?

And in one of the directories that I listed, it showed :

www-data@box:/scripts$ ls -l
ls -l
total 20
-rw-r--r-- 1 scriptmanager scriptmanager  88 Feb  8 09:11 dek.py
-rw-r--r-- 1 root          root            0 Feb  8 10:11 dik.py
-rw-r--r-- 1 www-data      www-data      129 Feb  8 09:25 mmm.py
-rw-r--r-- 1 scriptmanager scriptmanager  58 Dec  4 17:03 test.py
-rw-r--r-- 1 root          root           12 Feb  8 10:11 test.txt
-rw-r--r-- 1 www-data      www-data       85 Feb  8 10:08 tmp.py

Is there a way to priviledge escalate to a root shell? I have limited user shell without the password.

Sankalp Singha
  • 301
  • 1
  • 3
  • 6
  • 3
    For those considering answering: this is a HackTheBox challenge, so information that leads Sankalp in the right direction rather than gives them the exact answer on a plate would probably be best! – Polynomial Feb 08 '18 at 18:16
  • Thanks @Polynomial: Thats why I tried changing the names where the box name was listed. – Sankalp Singha Feb 08 '18 at 18:23

2 Answers2

3
(scriptmanager : scriptmanager) NOPASSWD: ALL

means that you can run any command as scriptmanager, and optionally set your group to scriptmanager when doing so. You won't need to provide a password when doing so. The scriptmanager user (or group) may or may not have the privileges you ultimately want.

jsf80238
  • 137
  • 6
  • Ok so basically I can chown a file or a folder to scriptmanager, however, that does not mean that I can run any command as the scriptmanager right? For that I would have to do something like ```su scriptmanager``` right? – Sankalp Singha Feb 08 '18 at 18:30
  • No, you can run any command as `scriptmanager` and do everything it can do. – forest Feb 09 '18 at 02:12
0

Try looking for files or executables that scriptmanager owns already that you can modify. Some of them may execute in a privileged context.

MutableLabs
  • 461
  • 4
  • 4