InfosecPrep Offsec PG Play Walkthrough

Today’s walkthrough will cover InfosecPrep, an Offsec PG Play machine that is rated Easy both in difficulty level and community rating. The first step is to perform an NMAP scan, where we see that open ports include TCP 22 (SSH), TCP 80 (HTTP), and TCP 33060 (MySQL X protocol listener). The results show a WordPress website, a (possibly) exploitable database, and SSH access through the official port.

NMAP scan — TCP ports 22, 80, and 33060 open

Opening the website shows critical information about the box. The last line is especially important, as it shows that the user of the box is “oscp”.

Additionally, the NMAP scan shows an interesting directory path called _secret, which leads to a Base64-encoded string. Decoding that string leads to an SSH key that allows for accessing the box. The SSH key must have read and write permissions for exclusively the file owner for it to work (also known as 600). Finally, connecting the puzzle with the user and key allows SSH login and leads to the user flag.

Initial Website Page Shows User as “oscp

_secret Directory Path Shows Base64-Encoded String

Decoding Base64-Encoded String Shows SSH Key

Using Decoded SSH Key File for SSH Access

User Flag

Privilege escalation is done through showing binary files with set SUID bits, with an interesting SUID binary known as /usr/bin/bash. This is an important way to escalate privilege as misconfigured SUID bits can cause improper root exploitation. The exploitation directions are in the link below, which leads to the root flag.

/usr/bin/bash has the SUID bit set

[embed]bash | GTFOBins Living off the land using "bash".gtfobins.org

Extracting root flag through bash binary

Hope you enjoyed reading this walkthrough! There will be more coming soon!