[lastage]

So by checking the env we can get this:
╔══════════╣ Environment
╚ Any private information inside environment variables?
HISTFILESIZE=0
MB_LDAP_BIND_DN=
LANGUAGE=en_US:en
USER=metabase
HOSTNAME=18aef233d2d5
FC_LANG=en-US
SHLVL=5
LD_LIBRARY_PATH=/opt/java/openjdk/lib/server:/opt/java/openjdk/lib:/opt/java/openjdk/../lib
HOME=/home/metabase
OLDPWD=/home/metabase/.ssh
MB_EMAIL_SMTP_PASSWORD=
LC_CTYPE=en_US.UTF-8
JAVA_VERSION=jdk-11.0.19+7
LOGNAME=metabase
_=./linpeas.sh
MB_DB_CONNECTION_URI=
PATH=/opt/java/openjdk/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
MB_DB_PASS=
MB_JETTY_HOST=0.0.0.0
META_PASS=An4lytics_ds20223#
LANG=en_US.UTF-8
MB_LDAP_PASSWORD=
HISTSIZE=0
SHELL=/bin/sh
MB_EMAIL_SMTP_USERNAME=
MB_DB_USER=
META_USER=metalytics
LC_ALL=en_US.UTF-8
JAVA_HOME=/opt/java/openjdk
PWD=/home/metabase
HISTFILE=/dev/null
MB_DB_FILE=//metabase.db/metabase.db


Here we can get a user from META_USER and a password from META_PASS, then we are able to ssh using the user and password combo

[Mia2024]

here is how to get root flag


CVE-2023-2640 & CVE-2023-32629

I have tried those cve's and I get a fake root. It shows i am root in the shell but nor permissions for anything else.
Any help?
Dont have any credits so no idea if you have posted an answer to that issue.

Just use this one https://github.com/briskets/CVE-2021-3493 as last post of page 2 suggested

Just because compiling on your own machine and sending it to the target often doesn't work, doesn't mean you shouldn't try it.

CVE-2023-38646 is most recent

[hackTheFlag]

Writeups are here: https://hacktheflag.to/machines/569
Enjoy

[Addka72424]

The last non-spam response in the topic was more than a month ago. I close the topic as irrelevant to prevent spam. If this is not the case, please send a pm and I will open the topic for discussion again.