Linux Hackers Become Root with CURL & Sudo
Source: YouTube · John Hammond · published Jun 4, 2024 · 18:46
This video demonstrates solving the "curly fries" CTF privilege escalation challenge by abusing sudo configurations to obtain a root shell 0:00-0:32.
Key Takeaways:
• The first step uses sudo -l to identify a curl rule for user "fry," enabling the attacker to serve a symbolic link via a Python server and read fry's bash history to recover a password 1:10-5:10.
• After accessing the "fry" account, a second wildcard sudo permission allows running curl as root, which is exploited to read arbitrary local files using the file:// schema 9:12-12:05.
• The final escalation involves generating SSH keys, hosting the public key locally, and using curl to write it to the root user's authorized_keys file for passwordless access 13:30-17:04.
• With root access, the attacker executes a specific binary in the home directory that simulates interactive input to retrieve the final flag 17:20-17:52.
The walkthrough emphasizes the security risks associated with wildcard characters in sudoers rules, which facilitate privilege escalation through argument injection.
Sources:
- 0:00-0:32 Introduction to the challenge
- 1:10-5:10 Escalating to user fry via bash history
- 9:12-12:05 Discovering root wildcard permission and file read
- 13:30-17:04 SSH key injection for root access
- 17:20-17:52 Retrieving the flag
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
I created a capture the flag challenge called curly fries this was a miscellaneous task in the ncon capture the flag 20124 the fifth time we've hosted that game a ton of fun and this is a privilege escalation challenge with a special thanks to tiberious who gave me the inspiration for this after he had kind of an interesting solution for the end of bookstore which is another challenge I created for hacking Hub I can add a link in the description if you're interested in that but looks like all we need to do is escalate our Privileges and run the program in the root users home directory now this required an SSH connection I am running this locally because we have now turn down the infrastructure for the ncon capula flag I will try to get the challenges up and available for you in another loc…