Proving Grounds Practice — Pelican — giselle

Hello, today I’ll talk about the solution of Proving Grounds Practice’s Pelican machine.

First, we run an Nmap scan.

I started researching the exploits available on the services on the relevant ports and found the zookeeper exploit.

[]

We write our reverse shell payload in the java.env script field and listen with netcat. and we got our shell

We need to escalate privileges, so we run linpeas. We transfer the linpeas file to the machine with the python server.

In the linpeas output, the sudo/SUID privilege escalation section catches our eye.

An interesting file stands out for privilege escalation via gcore. (password-store)

We learn which command to run with gtfobins.

[gcore | GTFOBins]

Then we read the resulting file with the string command. There is a password inside, and we use it to switch to root.

Yes, we now have root. We can get our proof.txt file.

We find our flag and complete the challenge. Keep hacking !

Practice makes perfect :)