dreadnaught- Machine
- PC
- OS
- Linux
- Difficulty
- Easy
- Steps
- 3
- Added
- 7 Oct 2023
A gRPC service exposes a SQL injection for a user shell; a loopback-only pyLoad, tunnelled out, has a pre-auth RCE as root.
How it went
- 0nmap
An nmap scan of all ports finds a gRPC service on 50051.
- 1gRPC id
grpcurl enumerates the service; a token from login exposes an id parameter that is injectable.
- 2SQLi
Driving SQLmap through a small proxy dumps credentials for an SSH login as sau and the user flag.
- 3pyLoad RCE
A loopback-only pyLoad on port 8000, tunnelled out, has a pre-auth RCE that runs as root.