Pwnkit

Walkthrough summary

Pwnkit TryHackMe walkthrough with 4 answered prompts and lab methodology notes.

Sample prompts covered

• This room will provide an overview of the vulnerability, as well as recommendations to patch affected systems. A vulnerable machine has also been attached to allow you to try the vulnerability for yourself!
  Open the walkthrough page to inspect the full answer and command flow.
• > For example, what happens when you need to execute a file, but as the admin user (root)? A good example of this is the passwd command in Linux. As a low privileged user, you don’t have permission to access the system files which contain the passwords, but you can still change your password with the passwdcommand, so how does this work?
  Open the walkthrough page to inspect the full answer and command flow.
• > To reference SUID, we use the number 4. To reference SGID we use the number 2, and to reference sticky bit, we use the number 1. When adding these to a permission definition, we just add them on at the start of the three numbers we used previously.
  Open the walkthrough page to inspect the full answer and command flow.
• *In other words, full permissions plus the sticky bit would look like this: 1777. Adding SUID to a file that the owner can read and write to, and everyone else can read, would look like this: 4644. Adding the SGID bit to a file that can be read by everyone, and modified/executed by no one, would look like this: 2444.*
  Open the walkthrough page to inspect the full answer and command flow.