dreadnaught- Machine
- Interpreter
- OS
- Linux
- Difficulty
- Medium
- Steps
- 3
- Added
- 21 Feb 2026
A pre-auth Mirth Connect deserialization RCE (CVE-2023-43208) gives a shell; DB creds leak a crackable PBKDF2 hash, and a root notif.py eval() injection gives root.
How it went
- 0nmap
nmap shows SSH and Mirth Connect (Jetty) on 80 and 443.
- 1Mirth RCE
Mirth Connect 4.4.0 falls to a pre-auth XStream deserialization RCE (CVE-2023-43208), giving a shell as mirth.
- 2sedric
mirth.properties holds DB creds; the Mirth database yields sedric's PBKDF2 hash, which cracks to an SSH password.
- 3eval() inject
notif.py runs as root and eval()s an f-string; a chr()-built payload in a patient field injects a root shell.