dreadnaught- Machine
- LaCasaDePapel
- OS
- Linux
- Difficulty
- Easy
- Steps
- 4
- Added
- 30 Mar 2019
A vsftpd 2.3.4 backdoor drops into a PHP Psy Shell; a stolen CA key forges a client cert, path traversal grabs an SSH key, and a writable supervisord config gives root.
How it went
- 0nmap
nmap shows vsftpd 2.3.4 and an HTTPS site on 443 that demands a client certificate.
- 1vsftpd backdoor
The vsftpd 2.3.4 backdoor(CVE-2011-2523) gets us a shell as dali.
- 2client cert
The Psy Shell reads nairobi's CA key; signing a client cert with it unlocks the HTTPS app.
- 3path traversal
The HTTPS file browser's base64 path parameter traverses to the user flag and professor's SSH key.
- 4supervisord
professor owns the directory holding supervisord's memcached.ini; replacing it runs a command as root.