dreadnaught- Machine
- MonitorsFour
- OS
- Windows
- Difficulty
- Easy
- Steps
- 3
- Added
- 6 Dec 2025
An API IDOR leaks MD5 hashes that log into Cacti; an rrdtool injection gives a container webshell, and Docker Desktop's unauthenticated Engine API escapes to the Windows host.
How it went
- 0nmap
nmap shows nginx and WinRM; an exposed .env confirms a Docker backend.
- 1IDOR
An API IDOR (token=0) dumps every user's MD5 hash; marcus's cracks to wonderful1.
- 2Cacti RCE
Those creds log into Cacti 1.2.28; an rrdtool newline injection (CVE-2025-24367) writes a webshell as www-data in a container.
- 3Docker escape
The container reaches Docker Desktop's unauthenticated Engine API (CVE-2025-9074) to start a privileged host-mounted container and read the Windows flags.