Pc 🔸

Enumeration

Initial Access

Going to port 8000, we are in a terminal.

Privilege Escalation

We can see a script that opens port 65432.

Looking at the code, this is an RPC app.

Searching for rpc exploits:

https://github.com/ehtec/rpcpy-exploit

Change the payload to chmod +s /bin/bash.

Post Exploitation

Get the flag.