dreadnaught- Machine
- iClean
- OS
- Linux
- Difficulty
- Medium
- Steps
- 4
- Added
- 3 Aug 2024
An XSS steals an admin cookie and a Jinja2 SSTI gives a shell; cracked creds reach a user, and a sudo qpdf reads root's key.
How it went
- 0nmap
A full-port nmap scan redirects to capiclean.htb.
- 1XSS cookie
A stored XSS in the service field steals an admin session cookie for the dashboard.
- 2Jinja2 SSTI
The QR qr_link field is vulnerable to Jinja2 SSTI, giving code execution as www-data.
- 3consuela
Database credentials recovered from the app crack to Consuela's password for an SSH login and the user flag.
- 4sudo qpdf
Consuela can sudo qpdf; its --add-attachment option embeds root's SSH key into a PDF to read it out.