SUID
OFFSEC - Proving Grounds - SCARECROW1.1
·1985 words·10 mins
OFFSEC PG PRACTICE
XXE
PHP WRAPPER
NEWLINE INJECTION
SUID
Used XXE and PHP wrappers to read files/source code, bypassed the upload blacklist with a PHP reverse shell for initial access, then exploited SUID find to escalate privileges to root.
OFFSEC - Proving Grounds - DECEPTION
·1886 words·9 mins
OFFSEC PG PRACTICE
WORDPRESS
SUID
WordPress enumeration revealed users and a hint leading to a split password. We combined it to gain SSH access, then exploited SUID /usr/bin/python2.7 to escalate privileges to root.
OFFSEC - Proving Grounds - CONFUSION
·2036 words·10 mins
OFFSEC PG PRACTICE
CACTI
DOAS
SUID
A Cacti HTTPS exploit is adapted for RCE. Database credentials enable lateral movement to james, who can modify /usr/local/sbin/systeminfo and run it as root via doas, enabling privilege escalation.