dreadnaught- Machine
- Jupiter
- OS
- Linux
- Difficulty
- Medium
- Steps
- 4
- Added
- 21 Oct 2023
A Grafana SQL injection gives a shell; a YAML race and a local Jupyter reach two users, and a writable sudo binary gives root.
How it went
- 0nmap
A full-port nmap scan redirects to jupiter.htb.
- 1Grafana SQLi
Fuzzing finds a kiosk.jupiter.htb Grafana whose API runs raw PostgreSQL; SQLmap's os-shell lands a shell as postgres.
- 2juno
pspy reveals a job that resets network-simulation.yml; winning the race injects Python to drop an SSH key for juno and the user flag.
- 3jovian
A local Jupyter on 8888, tunnelled out with chisel, yields a token for a shell as jovian.
- 4sudo sattrack
jovian can sudo the sattrack binary; replacing the writable binary with bash gives root.