dreadnaught- Machine
- Unbalanced
- OS
- Linux
- Difficulty
- Hard
- Steps
- 5
- Added
- 23 Mar 2023
An EncFS RSync backup leaks the Squid password; the proxy exposes an internal intranet, an XPath brute gives a user, and a Pi-hole gives root.
How it went
- 0nmap
An nmap scan shows exposed RSync and a Squid proxy.
- 1RSync EncFS
Anonymous RSync pulls an EncFS-encrypted backup; encfs2john cracks it to 'bubblegum', and decrypting leaks the Squid password.
- 2Squid fqdncache
squidclient uses that password to query the proxy's fqdncache, revealing an internal intranet.
- 3XPath brute
The intranet login falls to a SQL bypass and a blind XPath injection that brute-forces user passwords.
- 4bryan
Bryan is the only local account among them, so his password logs in over SSH for the user flag.
- 5Pi-hole RCE
An internal Pi-hole (admin) has an authenticated RCE; as www-data its config password is readable in /root, giving root over su.