# pc

**Source**: Proving Grounds\
**OS**: Linux\
**Community Rating**: Intermediate

## Enumeration & Reconnaissance

* I ran autorecon as usual and discovered two open ports on the target:
  * **SSH (22)**
  * **HTTP (8000)**

## Service Analysis

* Checking HTTP (8000) revealed a built-in terminal that allowed direct interaction with the system as a regular user.&#x20;
* This meant that initial access was already in place, we just needed to focus on privilege escalation (which explains why there was only a root flag).

## Gaining Initial Access

* Since the terminal on port 8000 already granted user-level access, I didn’t have to worry about exploiting an initial vulnerability. My starting point was already set.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2F5eG9S3v5tyXWp7ZjdNUq%2Fimage.png?alt=media&#x26;token=7ccf509a-63bc-4f54-965e-21650b0dc4af" alt="" width="375"><figcaption><p>Port 8000 Terminal</p></figcaption></figure>

## Privilege Escalation

* While exploring the file system, I noticed a snap folder containing **lxd** and **ttyd**. LXD is an open-source solution for managing virtual machines and containers, its misconfigurations can sometimes be exploited for privilege escalation. I tried a few angles there, but I wasn’t in the lxc or lxd group, so that approach hit a dead end.
* Running linpeas.sh, I discovered that root was running a Python script located at **/opt/rpc.py**. I attempted to write to this file directly, but my permissions were insufficient.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FholOXXx2T3XMdUbojSQx%2Fimage.png?alt=media&#x26;token=8b100454-c82b-4e27-a677-ddcfa53d4f48" alt="" width="563"><figcaption><p>RPC.py</p></figcaption></figure>

* After some online research, I found that there is a CVE associated with **rpc.py** that allows privilege escalation. I first tried the PoC available on Exploit-DB, but it didn't work. Then I found another PoC on GitHub that worked perfectly, using it, I was able to escalate my privileges and obtain a root shell!

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2Fjl5qTcNMxyUPRpVte8Ju%2Fimage.png?alt=media&#x26;token=88ec9215-f573-4af3-a467-32b99ee1b4d6" alt="" width="563"><figcaption><p>Privilege Escalation</p></figcaption></figure>

{% hint style="info" %}
_Side note:_ linpeas.sh also revealed another port that autorecon/nmap didn’t pick up. This serves as a reminder to always double-check all open ports, as they might offer alternative attack vectors if the primary approach fails.
{% endhint %}

#### Lessons Learned

* **Check for CVEs**: The rpc.py vulnerability (CVE) provided a privilege escalation path.
* **Verify all open ports**: Linpeas revealed an undiscovered port, highlighting the need for thorough checks.
