dreadnaught- Machine
- Buff
- OS
- Windows
- Difficulty
- Easy
- Steps
- 3
- Added
- 23 Mar 2023
A public RCE in Gym Management System gives a foothold; a local-only CloudMe service is tunnelled out and overflowed for admin.
How it went
- 0nmap
An nmap scan shows a web app on port 8080.
- 1Gym Mgmt RCE
Gym Management System runs on 8080 with a public unauthenticated RCE, landing a shell as shaun and the user flag.
- 2CloudMe tunnel
A local-only CloudMe 1.11.2 on port 8888 is tunnelled out with plink.
- 3buffer overflow
The overflow runs the payload as the CloudMe user, giving administrator.