dreadnaught- Machine
- Time
- OS
- Linux
- Difficulty
- Medium
- Steps
- 2
- Added
- 23 Mar 2023
A Jackson deserialization RCE gives a shell; a world-writable root backup script gives root.
How it went
- 0nmap
An nmap scan shows a JSON-formatting web app.
- 1Jackson RCE
A failed parse reveals Jackson; a deserialization RCE via an H2 RUNSCRIPT payload gives a shell and the user flag.
- 2writable script
A root-run backup script is world-writable; appending an SSH key to root's authorized_keys gives a root login.