dreadnaught- Machine
- Feline
- OS
- Linux
- Difficulty
- Hard
- Steps
- 3
- Added
- 23 Mar 2023
A Tomcat session-deserialization RCE gives a shell; a SaltStack RCE gives container root, and the host's Docker socket gives root on the host.
How it went
- 0nmap
An nmap scan shows a malware-analysis web app on 8080, backed by Tomcat.
- 1Tomcat deserial
The upload stores files at a known path; Tomcat's CVE-2020-9484 session-persistence deserialization, triggered via a ysoserial payload and a crafted JSESSIONID, gives a shell as tomcat and the user flag.
- 2SaltStack RCE
An internal SaltStack on 4505/4506, reached over a chisel tunnel, is exploited with CVE-2020-11651 for root inside the container.
- 3Docker socket
Root's bash history points at the host's Docker socket; forwarded out with socat, it runs a container mounting the host root filesystem for root on the host.