dreadnaught- Machine
- Mailroom
- OS
- Linux
- Difficulty
- Hard
- Steps
- 6
- Added
- 19 Aug 2023
A blind XSS proxies an internal panel and a NoSQL injection dumps a password; a panel command injection gives www-data, a leaked Git config reaches Matthew, and a KeePass password straced from a process gives root.
How it went
- 0nmap
An nmap scan shows a shipping site; ffuf and the Git repo's auth.php reveal Git and staff-review-panel subdomains.
- 1blind XSS
A stored XSS in the contact form makes the viewer's browser request the 403-protected staff-review-panel on our behalf.
- 2NoSQL inject
The panel's MongoDB auth.php is vulnerable to a NoSQL injection; a $ne then a $regex brute, driven through the XSS, dumps Tristan's password.
- 3tristan
Tristan's password logs in over SSH; a token in the mail spool plus SSH forwarding open the staff panel fully.
- 4inspect.php
inspect.php fails to filter backticks, so a staged PHP reverse shell runs as www-data.
- 5matthew
Matthew's credentials sit in a Git config readable as www-data; su lands his account and the user flag.
- 6KeePass strace
pspy shows kpcli opened periodically; stracing it recovers the keybox password (minus a stray backspace), and its Root entry gives su to root.