dreadnaught- Machine
- MonitorsTwo
- OS
- Linux
- Difficulty
- Easy
- Steps
- 4
- Added
- 2 Sep 2023
A Cacti RCE gives a container shell; cracked DB creds give a user, and a Docker overlay flaw escalates to host root.
How it went
- 0nmap
An nmap scan shows Cacti running on port 80.
- 1Cacti RCE
An unauthenticated Cacti RCE lands a shell inside a container.
- 2marcus
The container's entrypoint leaks SQL credentials; a dumped hash cracks to marcus:funkymonkey for an SSH login and the user flag.
- 3SUID capsh
A SUID capsh inside the container spawns a root shell there.
- 4Docker overlay
A Docker overlay flaw exposes the container filesystem on the host, so a SUID binary built as container-root runs as root on the host.