dreadnaught- Machine
- Laboratory
- OS
- Linux
- Difficulty
- Easy
- Steps
- 4
- Added
- 23 Mar 2023
A GitLab file-read leads to a deserialization RCE; a SUID binary with a relative chmod call gives root via a PATH hijack.
How it went
- 0nmap
An nmap scan redirects to laboratory.htb over HTTPS.
- 1GitLab vhost
Vhost fuzzing uncovers the git.laboratory.htb subdomain running GitLab.
- 2cookie forge
A GitLab file-read flaw leaks the secret key; a forged signed cookie triggers a deserialization RCE as git inside a container.
- 3dexter
The GitLab Rails console dumps and resets Dexter's account, yielding his SSH key for a login to the host and the user flag.
- 4docker-security
A SUID docker-security binary calls chmod by relative path; a PATH hijack points it at a planted binary for root.