dreadnaught- Machine
- Curling
- OS
- Linux
- Difficulty
- Easy
- Steps
- 4
- Added
- 23 Mar 2023
A hidden secret.txt leaks the Joomla admin password; a template edit gives a shell, and a root cron abusing curl's config flag gives root.
How it went
- 0nmap
An nmap scan shows a custom site on port 80.
- 1Joomla admin
A secret.txt comment base64-decodes to Curling2018!, the Joomla super-user password for Floris.
- 2template edit
Editing a Joomla template injects a PHP reverse shell as www-data.
- 3floris
A layered password_backup file in Floris's home decompresses to his password for an SSH login and the user flag.
- 4root cron
A root cron runs curl against a writable input file; its -K config option redirects output to overwrite /etc/passwd for a root shell.