dreadnaught- Machine
- Eloquia
- OS
- Windows
- Difficulty
- Insane
- Steps
- 4
- Added
- 13 Dec 2025
An AngularJS CSTI steals admin cookies; a Django SQL Explorer load_extension RCE gives a foothold, and a .NET AppDomainManager injection into a SYSTEM service gives root.
How it went
- 0nmap
nmap shows IIS (an ARR reverse proxy) and WinRM fronting two Django apps, eloquia.htb and qooqle.htb.
- 1AngularJS CSTI
An AngularJS CSTI in article content bypasses CSP via ng-focus and $event.view; a reported article steals the admin bot's cookies.
- 2load_extension
Admin's Django SQL Explorer plus a DLL uploaded as an article banner enables a SQLite load_extension RCE as eloquia\web.
- 3DPAPI creds
Decrypting the web user's Edge DPAPI store recovers Olivia.KAT's password, used via LogonUserW impersonation.
- 4AppDomainMgr
Olivia.KAT can write the Failure2Ban service directory; a .NET AppDomainManager injection runs as SYSTEM when the service restarts.