dreadnaught- Machine
- Cronos
- OS
- Linux
- Difficulty
- Medium
- Steps
- 4
- Added
- 23 Mar 2023
A DNS zone transfer and a login SQLi reach a command-injectable tool; a writable file in a root cron gives root.
How it went
- 0nmap
An nmap scan shows SSH, DNS, and a web server.
- 1dig subdomain
DNS enumeration with dig uncovers an admin.cronos.htb subdomain.
- 2SQLi bypass
The admin panel login is bypassed with SQL injection.
- 3cmd injection
Its Net Tool runs user input unsanitised, giving command injection as www-data and the user flag.
- 4root cron
A root cron runs a www-data-writable Laravel artisan file every minute; replacing it with a reverse shell lands root.