dreadnaught- Machine
- Agile
- OS
- Linux
- Difficulty
- Medium
- Steps
- 4
- Added
- 5 Aug 2023
A path traversal leaks a Flask secret for cookie forgery; a debug port and a sudoedit CVE lead to root.
How it went
- 0nmap
An nmap scan redirects to the superpass.htb Flask app.
- 1config leak
A download endpoint is path-traversable, leaking config_prod.json with SQL credentials and the Flask SECRET_KEY.
- 2Flask cookie
The secret key forges session cookies; cycling the user_id harvests other vault passwords, including Corum's SSH login for the user flag.
- 3edwards
An exposed chromedriver debug port, tunnelled in, reveals Edwards's credentials for a second SSH login.
- 4sudoedit CVE
A dev_admin cron runs a file editable via sudoedit; CVE-2023-22809 abuses the EDITOR to write it and land root.