Grandmaster rank emblem

Lvl 99

Level XP3,807/5,718

3807 of 5718
Grandmaster dreadnaught
Grandmaster rank emblem

Lvl 99

Level XP3,807/5,718

3807 of 5718
Grandmaster dreadnaught
Machine
Gavel
OS
Linux
Difficulty
Medium
Steps
4
Added
29 Nov 2025

An exposed .git reveals a rule engine that runs auction rules as PHP; a brute-forced auctioneer plants a webshell, and a root daemon's leaky PHP sandbox gives root.

0Reconnmap1Footholdexposed .git2Lateralrule RCE3Pivotauctioneer4Priv escsandbox escape
1Recon2Foothold3Lateral4Pivot5Priv escnmap1exposed .git2rule RCE3auctioneer4sandbox escape5

How it went

  1. 0
    nmap

    nmap shows SSH and an Apache-hosted PHP auction app, Gavel 2.0.

  2. 1
    exposed .git

    An exposed .git dumps the source; the bid handler runs each auction's rule column as PHP via runkit_function_add.

  3. 2
    rule RCE

    Brute-forcing the auctioneer login lets admin.php plant a webshell rule that fires when a user bids, giving www-data.

  4. 3
    auctioneer

    The auctioneer system account reuses the web password; su to it gives the user flag and gavel-seller group membership.

  5. 4
    sandbox escape

    The root gaveld socket runs a PHP sandbox that still allows file_put_contents; overwriting its php.ini and reloading it via RULE_PATH reads root's files.