dreadnaught- Machine
- Bookworm
- OS
- Linux
- Difficulty
- Insane
- Steps
- 5
- Added
- 20 Jan 2024
A CSP-bypassing XSS reaches a bot; a download traversal leaks creds, a file-converter traversal overwrites a user's keys, and a sudo genlabel PostScript injection writes root's keys.
How it went
- 0nmap
A full-port nmap scan serves the bookworm.htb Node.js shop.
- 1XSS + CSP bypass
Basket notes allow stored XSS; CSP is bypassed by uploading JavaScript as a profile picture, and spraying basket IDs lands it in a staff bot's session.
- 2download traversal
The bulk download ZIP takes an injectable bookIds parameter; path traversal reads the Node source and database, leaking frank's credentials.
- 3frank
frank:FrankTh3JobGiver logs in over SSH for the user flag.
- 4convert traversal
An internal file-conversion service on port 3001 mishandles its output path; a traversal plus a symlink overwrites Neil's authorized_keys for an SSH login as Neil.
- 5sudo genlabel
Neil can sudo a genlabel tool; a PostScript injection copies Neil's key into root's authorized_keys for a root login.