Intro

This is my first dive into a Season box, let's dive in with 10.129.245.100. https://app.hackthebox.com/machines/Connected

This investigation is currently active on HackTheBox, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution.

Conclusion

Oh man. The initial exploitation was super easy using metasploit to automate the payload execution. I spent hours falling down rabbit holes on the priv esc. I figured since our username was asterisk, there was an executable named asterisk and the machine's image on HackTheBox looked like an old-school phone switchboard, that the privilege escalation had to deal with the asterisk application. I kept trying to get the two vulnerabilities for asterisk priv-esc to work and they did not. I ran LinPEAS and it noticed DirtyFrag as a potential chance, but unfortunately the mitigations were applied. I combed through the LinPEAS several times, and couldn't find anything to latch onto.

After manually searching through HackTricks, I started trying to manually find other configuration files we could write to, as it was rather atypical how much write access we had as a standard user. Even when I first found the additional configuration files, they looked uneventful.

I definitely learned something new about manual enumeration, and an alternative type of scheduled task.