Initial Access via Telnet#

Given the open Telnet port and the codename “pilot” obtained in Task 1, I attempted to log in directly. I used the -l flag to specify the user.

1
telnet -l pilot 10.66.170.132

Output:

1
Trying 10.66.170.132...
2
Connected to 10.66.170.132.
3
Escape character is '^]'.
4
FreeBSD 11.2-STABLE (GENERIC) #0 r345837: Thu Apr  4 02:07:22 UTC 2019
5

6
Welcome to FreeBSD!
7
[pilot@freebsd ~]$

We successfully established a session without needing a password. This confirms the premise that the drone’s OS is highly insecure.

Capturing the User Flag#

Once inside, I listed the files in the current directory and found user.txt.

I read the file to capture the flag.

Answer 1

What is the User Flag?

THM{REDACTED}

Privilege Escalation#

Pretty much the first thing you usually do when aiming for privesc on a Linux computer is look to see what you can run as sudo. Running sudo -l and see if we can run anything as root:

NOTE

BusyBox: is software that provides several stripped-down Unix tools in a single executable file. It is often found in embedded devices like drones to save disk space. Since we can run busybox as root, we can execute any of its internal commands (like sh) with root privileges.

Enumerating BusyBox Capabilities#

To see exactly which commands (applets) were available inside this BusyBox binary, I ran it without arguments:

1
sudo busybox

I spotted sh in the list of defined functions. This confirms we can spawn a shell.

Rooting the Drone#

I executed the sh command through the sudo-enabled busybox binary. Since busybox runs as root, the shell it spawns inherits those privileges.

Success! I verified access to the root directory and captured the final flag.

1
# cat /root/root.txt
2
THM{REDACTED}