Secrets in processes and local services
At the Blue Bubble Laundry the agents and services talk to each other on the same machine. Look at what is running (and with which arguments), find out which services listen locally and check whether a secret can end up in the wrong hands.
Lab 4 of 5 in the Privilege Escalation path. If you get stuck you have 3 hints, from the vaguest to the most precise: they cost 0, 50 and 150 XP.
What you learn
Objectives complete themselves while you work in the terminal; each one is worth experience points:
- List the running processes (100 XP)
- Read the banner of the local service on port 7070 (150 XP)
- Authenticate to the hub with the secret you found (200 XP)
Topics: privesc, processi, segreti, audit.
Commands you will use
The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:
ps: lists running processes with their arguments, which every user on the machine can see.grep: finds the lines that contain a word, even across whole folders with -r. It is the main tool for analysing text and logs.nmap: discovers the live hosts of a network and the open ports of a machine, with services and versions. Defenders use it to compare the real network with the inventory.nc: netcat opens a raw connection to a port and shows what the service answers, including its greeting message (banner).curl: makes HTTP requests from the terminal and shows the server’s raw answer, headers included.|: the vertical bar | chains commands: the output of the first becomes the input of the next, so small tools form a complete analysis.
The simulated environment
You work in a simulated Linux shell, in the home folder of the user runner: invented files and folders, no network target.
Besides the home folder there is a complete simulated system, with configuration files, logs, users and permissions to examine.
Local services also run on the machine:
- SSH: encrypted remote command-line access; it is protected with keys instead of passwords and without direct root login.
- Database: a database (MySQL, MariaDB or PostgreSQL), which should answer only the services that use it and never the whole network.
- Web (HTTP): a web server with pages, APIs or admin panels: the most exposed part of almost every organisation.
The defensive lesson
Once the lab is solved, the write-up explains what went wrong and how to protect yourself:
Process arguments are public: ps shows them to every user (and they also end up in audit logs). A token passed with --token is like writing it on a sign. Defensive lesson: pass secrets through the service's environment variables, files with 600 permissions or a secrets manager, never as arguments; mount /proc with hidepid=2, rotate the token as soon as it has been exposed and give local services per-client credentials with minimal scope.
Before and after this lab
To unlock it you must have solved:
- Forgotten secrets (Privilege Escalation, medium)
- Service banners (Recon & Scanning, easy)
After this lab you can move on to:
- Sudo and SUID audit (Privilege Escalation, hard)
The Privilege Escalation path
Privilege Escalation is an audit path here: you are on a server as a normal user and you check whether some misconfiguration lets you gain more privileges than you should have. You examine sudo rules, programs with the SUID bit, credentials forgotten in the history and in files, and secrets passed as process arguments. These are the same checks that people who harden systems run, and each lab ends with the principle that sums them all up: least privilege.