VIM Shell | Ryan's CTF [06] Escape the Jail

Key Takeaways

this challenge from Ryan Nicholson CTF is called escape to jail for 30 points in the intermediate category it says enter the flag within the route flag text file so it's in the route home directory we can go ahead into their web shell log in with the credentials they gave us CTF 2 and challenge 2 but unfortunately we are not the root user we're only simply the competitor user so we can't move into that directory or take a look at what that flag particularly is so we need to escape the jail and determine what this may be and actually a privilege escalation situation so let's do some enumeration and actually see what we can run with the sudo command because that will allow us to borrow the root users like power and privileges so if you run sudo tak L you can see entries in the etc sudoers file and says what we can do here so user competitor in our case that's us may run the following commands on this host without a password and that's a user bin vim so that's pretty awesome we can sudo user bin vim or just straight-up vim if we wanted to and now we are running the VI or VI improved command line text editor as root and we can do interesting things with this like if we wanted to we can go ahead and edit the route or flag text file and then we could actually view the flag just like that or if we were to use colon and type in shell that would give us simply a bash shell and now you can see that ok we are the root user that's awesome to get remote code execution and just do the privilege escalation to get to be the root user so if we wanted to even from the show we could cat out the flag that we're looking for and we'd submit that as our solution and get that get the points through that we can take note of this in our own specific notes and we can mark that challenge as complete but that enumeration or basic reconnaissance of a box see what we can use for privilege escalation check the pseudo list and see what commands you can run easily that's good notes and good tips to learn from hack the box if you don't play that that war game but that's awesome for learning hey I need to give a special shout-out and some love to people that support me on patreon this list is getting longer every every day and it's just surreal to me I'm so thankful for you guys $1 a month on patreon will give you a special shout-out just like this at the end of every video five dollars a month on Pay I'll give you early access to everything now release on YouTube if you did like this video please do like comment subscribe hang out with us on discord link in the description and check me out on patreon thanks