dreadnaught- Machine
- Conversor
- OS
- Linux
- Difficulty
- Easy
- Steps
- 4
- Added
- 25 Oct 2025
An unrestricted XSLT converter writes a file as www-data; a cron job runs it, a cracked DB hash gives SSH, and sudo needrestart (CVE-2024-48990) gives root.
How it went
- 0nmap
nmap shows SSH and an Apache-fronted Flask XML/XSLT converter.
- 1XSLT write
The XSLT parser is unrestricted, so an exsl:document stylesheet writes a file as www-data.
- 2cron RCE
Dropping a Python script into the cron-watched scripts/ dir runs it as www-data within a minute.
- 3crack hash
Dumping the SQLite DB yields fismathack's MD5 hash, which cracks to an SSH password.
- 4needrestart
fismathack may sudo needrestart 3.5; a poisoned PYTHONPATH (CVE-2024-48990) runs code as root.