dreadnaught- Machine
- Doctor
- OS
- Linux
- Difficulty
- Easy
- Steps
- 3
- Added
- 23 Mar 2023
A server-side injection in a portal gives a shell; a password in a log gives a user, and Splunk gives root.
How it went
- 0nmap
An nmap scan shows a medical services site that resolves to doctors.htb.
- 1message inject
The portal is vulnerable to a server-side injection; a crafted message yields a reverse shell.
- 2shaun
LinPEAS finds Shaun's password in a botched password-reset log; su to Shaun for the user flag.
- 3Splunk
Splunk runs on the box; SplunkWhisperer2 with Shaun's credentials executes a payload as root.