dreadnaught- Machine
- Browsed
- OS
- Linux
- Difficulty
- Medium
- Steps
- 4
- Added
- 10 Jan 2026
A malicious Chrome extension exfiltrates an internal Gitea; leaked source gives a bash arithmetic-eval shell, and a world-writable __pycache__ poisons a sudo script to root.
How it went
- 0nmap
nmap shows SSH and nginx serving browsed.htb.
- 1Chrome ext
An uploaded Chrome extension runs in the dev's browser; console.error exfiltrates the internal browsedinternals.htb Gitea.
- 2Gitea leak
Enumerating Gitea leaks larry/MarkdownPreview: a Flask /routines route that runs a bash [[ -eq ]] arithmetic eval.
- 3larry
A slash-free Python reverse shell injected via a[$(...)] lands as larry, whose SSH key gives stable access.
- 4pycache poison
larry may sudo extension_tool.py; its world-writable __pycache__ takes a poisoned UNCHECKED_HASH .pyc that makes a SUID bash as root.