[s1nn]

i GOT THE USER NO CLUES FOR ROOT PLS HELP

find lopez creds > reverse runner2

[Th3B4h0z]

lopez@intuition:~$ cat exploit.json
{
    "action": "install",
    "role_file": "nonexistent.yml; touch /tmp/testfile #",
    "auth_code": "UHI75GHINKOP"
}

lopez@intuition:~$ sudo /opt/runner2/runner2 exploit.json
Run key missing or invalid.
lopez@intuition:~$


What am I doing wrong

try like this

{
  "run":{
        "action":"install",
        "role_file":"xxx.tar"
        },
  "auth_code":"UHI75GHINKOP"
}

[KillerWhale]

lopez@intuition:~$ cat exploit.json
{
    "action": "install",
    "role_file": "nonexistent.yml; touch /tmp/testfile #",
    "auth_code": "UHI75GHINKOP"
}

lopez@intuition:~$ sudo /opt/runner2/runner2 exploit.json
Run key missing or invalid.
lopez@intuition:~$


What am I doing wrong

try like this

{
  "run":{
        "action":"install",
        "role_file":"xxx.tar"
        },
  "auth_code":"UHI75GHINKOP"
}

I got "Invalid tar archive". Any ideas?

[Th3B4h0z]

lopez@intuition:~$ cat exploit.json
{
    "action": "install",
    "role_file": "nonexistent.yml; touch /tmp/testfile #",
    "auth_code": "UHI75GHINKOP"
}

lopez@intuition:~$ sudo /opt/runner2/runner2 exploit.json
Run key missing or invalid.
lopez@intuition:~$


What am I doing wrong

try like this

{
  "run":{
        "action":"install",
        "role_file":"xxx.tar"
        },
  "auth_code":"UHI75GHINKOP"
}

I got "Invalid tar archive". Any ideas?

tar archive must have meta/main.yml

example tar role file 
https://github.com/coopdevs/sys-admins-r...0.3.tar.gz

[s0jnik]

lopez@intuition:~$ cat exploit.json
{
    "action": "install",
    "role_file": "nonexistent.yml; touch /tmp/testfile #",
    "auth_code": "UHI75GHINKOP"
}

lopez@intuition:~$ sudo /opt/runner2/runner2 exploit.json
Run key missing or invalid.
lopez@intuition:~$


What am I doing wrong

try like this

{
  "run":{
        "action":"install",
        "role_file":"xxx.tar"
        },
  "auth_code":"UHI75GHINKOP"
}

I got "Invalid tar archive". Any ideas?

tar archive must have meta/main.yml

example tar role file 
https://github.com/coopdevs/sys-admins-r...0.3.tar.gz

How to overcome this

lopez@intuition:/tmp$ /opt/runner2/runner2 test.json
Starting galaxy role install process
- extracting /tmp/sys-admins-role.tar to /tmp/sys-admins-role.tar
[WARNING]: - /tmp/sys-admins-role.tar was NOT installed successfully: the specified roles path exists and is not a directory.
ERROR! - you can use --ignore-errors to skip failed roles and finish processing the list.

[KillerWhale]

Finally got root. Thanks everyone!!!

[DrBan]

lopez@intuition:~$ cat exploit.json
{
    "action": "install",
    "role_file": "nonexistent.yml; touch /tmp/testfile #",
    "auth_code": "UHI75GHINKOP"
}

lopez@intuition:~$ sudo /opt/runner2/runner2 exploit.json
Run key missing or invalid.
lopez@intuition:~$


What am I doing wrong

try like this

{
  "run":{
        "action":"install",
        "role_file":"xxx.tar"
        },
  "auth_code":"UHI75GHINKOP"
}

I got "Invalid tar archive". Any ideas?

tar archive must have meta/main.yml

example tar role file 
https://github.com/coopdevs/sys-admins-r...0.3.tar.gz

How to overcome this

lopez@intuition:/tmp$ /opt/runner2/runner2 test.json
Starting galaxy role install process
- extracting /tmp/sys-admins-role.tar to /tmp/sys-admins-role.tar
[WARNING]: - /tmp/sys-admins-role.tar was NOT installed successfully: the specified roles path exists and is not a directory.
ERROR! - you can use --ignore-errors to skip failed roles and finish processing the list.

I got the lopez creds can you help with the root

[s0jnik]

try like this

{
  "run":{
        "action":"install",
        "role_file":"xxx.tar"
        },
  "auth_code":"UHI75GHINKOP"
}

I got "Invalid tar archive". Any ideas?

tar archive must have meta/main.yml

example tar role file 
https://github.com/coopdevs/sys-admins-r...0.3.tar.gz

How to overcome this

lopez@intuition:/tmp$ /opt/runner2/runner2 test.json
Starting galaxy role install process
- extracting /tmp/sys-admins-role.tar to /tmp/sys-admins-role.tar
[WARNING]: - /tmp/sys-admins-role.tar was NOT installed successfully: the specified roles path exists and is not a directory.
ERROR! - you can use --ignore-errors to skip failed roles and finish processing the list.

I got the lopez creds can you help with the root

still try to figure out how the runner binary works.
I can craft tar's that the binary tries to install and i found the action list and now i try to make the playbook run.
Still no idea how to leverage this to escalate to root

[br2023]

with lopez

lopez@intuition:~$ sudo -l
[sudo] password for lopez:
Matching Defaults entries for lopez on intuition:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User lopez may run the following commands on intuition:
    (ALL : ALL) /opt/runner2/runner2

[ritualist]

I'm in the same spot.
You can run the playbook e.g. like this
echo '{"run": { "action": "run", "num": 1 }, "auth_code": "UHI75GHINKOP"}' > cmd && sudo /opt/runner2/runner2 cmd

I can install my own roles successfully but I can't manage to run their code as root.