dreadnaught- Machine
- Snoopy
- OS
- Linux
- Difficulty
- Hard
- Steps
- 5
- Added
- 23 Sep 2023
An LFI leaks the DNS key to hijack mail and reset a Mattermost account; a provisioning feature captures an SSH login, then sudo git apply and sudo clamscan plant keys up to root.
How it went
- 0nmap
An nmap scan shows a web app, DNS, and a Mattermost subdomain.
- 1download LFI
A path traversal in the download link reads the filesystem, including the BIND config and its RNDC key.
- 2DNS hijack
The RNDC key authorises a dynamic DNS update pointing mail.snoopy.htb at the attacker, capturing a Mattermost password-reset email to take an account.
- 3cbrown
Mattermost's server-provisioning feature opens an outbound SSH connection to an attacker-set address; a fake SSH server captures cbrown's credentials for a login and the user flag.
- 4sudo git apply
cbrown can sudo git apply as sbrown; a crafted patch overwrites sbrown's authorized_keys for an SSH login as sbrown.
- 5sudo clamscan
sbrown can sudo clamscan; its Yara --copy option drops an attacker public key into root's authorized_keys for a root login.