dreadnaught- Machine
- Crossfit
- OS
- Linux
- Difficulty
- Insane
- Steps
- 6
- Added
- 23 Mar 2023
A blog XSS enumerates internal subdomains and creates an FTP account via CSRF; a writable share gives a shell, a cracked hash gives Hank, a shellcommand injection reaches Isaac, and a dbmsg race plants a root SSH key.
How it went
- 0nmap
An nmap scan shows FTP with a wildcard certificate and an Apache site; the certificate reveals a gym-club subdomain.
- 1blog XSS
A stored blog-comment XSS runs in a staff browser; JavaScript enumerates internal subdomains and finds an ftp.crossfit.htb account-management panel.
- 2CSRF account
The XSS reads the panel's CSRF token and posts to it, creating an FTP account.
- 3dev-test shell
FTP access exposes a writable development-test share; a PHP shell uploaded there and called internally gives code execution as www-data.
- 4hank
LinPEAS surfaces an Ansible playbook with Hank's password hash, which John cracks to powerpuffgirls for an SSH login as Hank and the user flag.
- 5isaac
Isaac's send_update cron uses a vulnerable shellcommand library; a malicious database email plus a message file dropped over FTP triggers command injection as Isaac.
- 6dbmsg race
Isaac can write /var/local, so a race against the root dbmsg binary symlinks root's authorized_keys to plant an SSH key for root.