dreadnaught- Machine
- Inject
- OS
- Linux
- Difficulty
- Easy
- Steps
- 4
- Added
- 8 Jul 2023
Path traversal exposes a Spring RCE for a shell; chained creds reach a second user, and an Ansible race condition gives root.
How it went
- 0nmap
An nmap scan shows a custom web app on port 8080.
- 1/show_image
Path traversal on /show_image exposes the app as Spring Boot.
- 2Spring RCE
A known Spring RCE lands a shell; dropping an authorized_keys file allows an SSH login as frank.
- 3phil
Phil's credentials sit in a .m2 directory; su to Phil for the user flag.
- 4playbook race
pspy reveals a root job that clears a writable tasks dir and runs an Ansible playbook; winning the race to plant a malicious playbook runs it as root.