dreadnaught- Machine
- Usage
- OS
- Linux
- Difficulty
- Easy
- Steps
- 4
- Added
- 2 Sep 2024
A password-reset SQLi opens the admin panel; an ExifTool upload gives a shell, chained creds reach a user, and a 7-Zip wildcard gives root.
How it went
- 0nmap
An nmap scan redirects to usage.htb.
- 1reset SQLi
The password-reset function is injectable; dumping and cracking admin_users opens the admin panel.
- 2ExifTool upload
An admin image upload runs an ExifTool-based command injection once renamed .php, giving a reverse shell.
- 3dash
dash's SSH key logs us in for the user flag; a recovered monitoring password then sus to the xander account.
- 47-Zip wildcard
xander can sudo a usage_management binary that mishandles 7-Zip wildcards; abusing it reads root's SSH key for root.