DEVELPY — TryHackMe WriteUp

DEVELPY is a LINUX machine of MEDIUM difficulty.

Do a rustscan to check for open ports:

So, there are two open ports, one is for SSH. Let’s check out the other:

I sent some text, and got this error:

So a python code is running which is using the input() method to take an integer as input.

Now, I remembered that python2 had a vulnerability in its input() function which lead to RCE. But, I wasn’t sure if this was code was in python2 or python3. But, anyways, I tried to use this.

I entered this:

__import__("os").system("id")

And well, looks like I just got RCE!

Let’s get a reverse shell out of this. I used this command:

Get user.txt from the current directory.

Next, I created a .ssh folder in king’s home directory, and provided a public key there, and then sshed to it.

There are some pretty interesting files in here. First, let’s have a look at the credentials.png file. I downloaded it to my local machine:

Hmmm………………

Anyways, we’ll come back to this later. Checking /etc/crontab as well while we’re at it:

Interesting. Let’s check these two files:

run.sh is running the exploit.py file, which we used to get RCE. The root.sh seems interesting though. It’s executing each and every file in the /root/company/media/ directory with the extension .py.

Let’s see if we have write or read permissions in that directory.

Guess we don’t.

BUT, I found another interesting thing:

/home/king/bin is in the PATH. It might be the same for the root, and root is executing the command python <something>. It does not specify the full path of the python binary. Maybe we can use it after all?

I created a file named python in the directory /home/king/bin. Inside it, I wrote this:

Then gave it executable permissions, and waited… But sadly, nothing. I tried the same in the /home/king/.local/bin directory as well, but again, nothing.

While thinking of what to do next, something just hit me! Can I delete the root.sh file?

Turns out I could -_-

I wrote this in this:

Then waited for a few minutes an did a bash -p:

Well, I’m root! Get the root.txt from root’s home directory.

But, this still got me wondering… what was that credentials.png file? It looks like piet… I downloaded the Windows executable from here, and ran:

.\npiet.exe .\credentials.png

Got this:

c00ffe123!king

This was actually the password of the user king. Well, we don’t need it anymore.

We have successfully pwned the box!