Hetemit 🔸

Enumeration

Initial Access

Going to port 50000, we have a Python API that shows...

At /verify we can inject code using os.system() because it is Python.

Using caido.

Get the flag.

Privilege Escalation

Checking with linpeas.

We can reboot the system and write to that service.

It's impossible to edit the file without a fully interactive shell, so let's use penelope.

https://github.com/brightio/penelope

Change the execution and the user.

We reboot and wait.

sudo /sbin/reboot

Post Exploitation

Get the flag.