Jurassic Park | Tryhackme

sudo python /usr/bin/jurassic Create a new Python script to exploit this:

import os os.system('/bin/bash') Save this script and execute it with sudo privileges: jurassic park tryhackme

sudo -l This will list the commands that can be executed with sudo privileges. Notice that the park user can execute the following command with sudo privileges: sudo python /usr/bin/jurassic Create a new Python script

unzip backup.zip Inside the unzipped directory, you'll find a file called dinosaur.cfg . This file contains credentials: jurassic park tryhackme

http://<machine_IP> You'll see a simple web page with a "Welcome to Jurassic Park" message. Perform directory bruteforcing using a tool like dirbuster or gobuster :