dreadnaught- Machine
- OnlyForYou
- OS
- Linux
- Difficulty
- Medium
- Steps
- 4
- Added
- 26 Aug 2023
A source leak exposes a command injection for a shell; a Neo4j injection reaches a user, and a sudo pip install gives root.
How it went
- 0nmap
A full-port nmap scan serves the only4you.htb site.
- 1source leak
A source-download feature on a beta subdomain is path-traversable, leaking the app's nginx config and Python source.
- 2dig injection
form.py passes an email domain into a shell dig command, giving command injection and a foothold.
- 3Neo4j to john
Internal Gogs and Neo4j services are reachable; a Cypher injection dumps john's password for an SSH login and the user flag.
- 4sudo pip
john can sudo pip to install a Gogs-hosted package; a malicious setup.py runs as root.