dreadnaught- Machine
- Alert
- OS
- Linux
- Difficulty
- Easy
- Steps
- 4
- Added
- 23 Nov 2024
Stored XSS in a markdown viewer drives the admin bot to read messages.php, whose path traversal leaks a .htpasswd; the cracked hash gives SSH as albert, and a management-group-writable config included by a root monitor injects PHP for root.
How it went
- 0nmap
nmap shows Apache serving a Markdown Viewer app.
- 1markdown XSS
Uploaded markdown renders unfiltered HTML, giving stored XSS against the admin bot that visits shared links.
- 2LFI via XSS
The XSS reads messages.php, whose file parameter is a path traversal exposing the Apache config and a statistics vhost .htpasswd.
- 3albert SSH
The .htpasswd hash cracks from rockyou and logs in over SSH as albert for the user flag.
- 4PHP Injection
albert's management group can write configuration.php, included by a root-run monitor; injected PHP runs as root.