dreadnaught- Machine
- Passage
- OS
- Linux
- Difficulty
- Medium
- Steps
- 4
- Added
- 23 Mar 2023
A CuteNews RCE gives a shell; decoded hashes and a reused SSH key reach two users, and a USBCreator D-Bus flaw gives root.
How it went
- 0nmap
An nmap scan shows a CuteNews blog on port 80.
- 1CuteNews RCE
CuteNews is exploited through its avatar upload for code execution as www-data.
- 2paul
Base64 user records under cdata decode to hashes; Paul's cracks, and a reverse shell drops into his account for the user flag.
- 3nadav
Paul's SSH key is reused in Nadav's authorized_keys, giving SSH access as Nadav.
- 4USBCreator
A USBCreator D-Bus privilege-escalation flaw reads root's SSH key for a root login.