boot2root

Search for various means to pass root on the ISO given to you (42 project)

Table of Contents

Mandatory part:

• Following the main puzzle
• Via Linux Exploit (Dirty Cow)

Bonus part:

• Binary exploitation using ret2libc
• Shellcode with environment variable
• Exploit suExec
• Reverse shell from phpmyadmin

Get IP address of the VM

Many options exist to get the IP address of the machine. We have create a script to obtain it.

Intelligence gathering

We want to obtain informations about services:

$nmap -A -p- $IP

With -A option we can detect all elements (script, OS, version and traceroute). -p- scan all ports.

SERVICE NAME	PORT	VERSION
ftp	21	vsftpd 2.0.8
ssh	22	OpenSSH 5.9
http	80	Apache 2.2.22
imap	143	Dovecot IMAP4rev1
ssl/http	443	Apache 2.2.22
ssl/imaps	993	?

The VM is running on Linux 3.2.