dreadnaught- Machine
- Precious
- OS
- Linux
- Difficulty
- Easy
- Steps
- 3
- Added
- 21 May 2023
A PDFKit command injection gives a shell; a leaked bundle config reaches a user, and a sudo Ruby YAML load gives root.
How it went
- 0nmap
An nmap scan shows a PDF-generation web app.
- 1PDFKit 0.8.6
The site uses PDFKit 0.8.6, vulnerable to command injection via the URL field, giving a reverse shell.
- 2henry
A ~/.bundle config leaks Henry's password for an SSH login and the user flag.
- 3YAML deserial
A sudo Ruby script loads dependencies.yml from the current directory; a malicious YAML deserialization payload runs as root.