This article details a cybersecurity challenge involving SSH enumeration, restricted shell bypass, and privilege escalation through Ruby script exploitation. It highlights techniques like unsafe reflection, local service enumeration, and SUID payloads to escalate privileges and capture flags. #RubyReflection #PrivilegeEscalation
Keypoints
- The challenge starts with SSH brute-force using a password hint and the Hydra tool.
- The user is initially placed in a restricted rzsh shell with limited command access.
- Unsafe reflection in Ruby scripts can be exploited to execute system commands and escape restrictions.
- Local services can be enumerated using custom Ruby scripts like netstat.rb.
- Privilege escalation is achieved by copying Bash to /tmp and setting the SUID bit for root access.