dreadnaught- Machine
- Format
- OS
- Linux
- Difficulty
- Medium
- Steps
- 5
- Added
- 30 Sep 2023
A template file-write and a Redis HTTP-splitting trick give a Pro account and a shell; a Redis dump reaches Cooper, and a sudo license tool leaks the root password.
How it went
- 0nmap
A full-port nmap scan shows Microblog on 80 and Gitea on 3000.
- 1edit template
The Microblog source on Gitea reveals an edit template whose id parameter reads and writes arbitrary files.
- 2Redis splitting
That file read exposes the nginx config; HTTP response splitting into the Redis socket flips an account to Pro.
- 3PHP shell
Pro accounts can write to /uploads, so a PHP shell lands there as www-data.
- 4cooper
From the shell, dumping the Redis socket reveals Cooper's password for su to Cooper and the user flag.
- 5sudo license
Cooper can sudo a license tool; a format-string flaw dumps globals and the encryption secret, which decrypts the stored root password for a root shell.