dreadnaught- Machine
- ScriptKiddie
- OS
- Linux
- Difficulty
- Easy
- Steps
- 3
- Added
- 23 Mar 2023
An APK template injection gives a shell as kid; a writable log reaches pwn, and passwordless sudo msfconsole gives root.
How it went
- 0nmap
An nmap scan shows a custom web app on port 5000.
- 1APK template
The msfvenom template feature is vulnerable to APK template command injection, giving a shell as kid and the user flag.
- 2scanlosers.sh
pwn's scanlosers.sh processes a writable log file; injecting a command yields a shell as pwn.
- 3sudo msfconsole
pwn has passwordless sudo on msfconsole, whose shell runs as root.