dreadnaught- Machine
- Photobomb
- OS
- Linux
- Difficulty
- Easy
- Steps
- 3
- Added
- 4 Sep 2023
Hardcoded JS credentials reach an injectable endpoint for a shell; a sudo script with a relative call gives root via PATH.
How it went
- 0nmap
An nmap scan shows SSH and an nginx site at photobomb.htb.
- 1photobomb.js
A photobomb.js script hardcodes the credentials pH0t0:b0Mb! for the printer page.
- 2filetype inject
The filetype parameter is injectable, giving command execution and a reverse shell as wizard for the user flag.
- 3cleanup.sh
A sudo cleanup script calls [ without an absolute path; with SETENV, a PATH hijack makes a planted [ run as root.