dreadnaught- Machine
- Beep
- OS
- Linux
- Difficulty
- Easy
- Steps
- 2
- Added
- 23 Mar 2023
An Elastix LFI leaks a reused password that the root account also uses.
How it went
- 0nmap
An nmap scan shows a busy host; the HTTPS Elastix PBX login stands out.
- 1graph.php LFI
Elastix 2.2.0's graph.php LFI reads amportal.conf and exposes a reused password.
- 2SSH as root
The password is sprayed across SSH users; root reuses it, landing both flags.