dreadnaught- Machine
- Cobblestone
- OS
- Linux
- Difficulty
- Insane
- Steps
- 4
- Added
- 9 Aug 2025
A second-order SQLi with the MySQL FILE privilege writes a webshell; a cracked admin hash gives an rbash SSH shell, and a root Cobbler API command injection gives root.
How it went
- 0nmap
nmap shows SSH and Apache; the main site exposes vote and deploy subdomains.
- 12nd-order SQLi
A second-order SQLi (stored in suggest.php, fired in details.php) runs as a voteuser holding the MySQL FILE privilege.
- 2INTO OUTFILE
LOAD_FILE leaks the app source and configs; since MariaDB has no AppArmor profile, INTO OUTFILE drops a PHP webshell as www-data.
- 3cobble
mysqldump yields admin SHA256 hashes; cobble's cracks from rockyou, giving an rbash SSH shell and the user flag.
- 4Cobbler RCE
SSH port-forwarding reaches the root Cobbler XMLRPC API; default creds plus a background_import command injection (CVE-2024-47533) run as root.