Api

Overview Machine author: rastating. Focus: privilege escalation (misconfiguration / service abuse, and a ret2libc BOF). 1 2 3 4 5 6 7 8 9 10 recon +- leaky API /api/users/ -> crack hashes -> login as web admin v download myplace.backup (base64 -> zip) +- crack the zip password (john) -> application source -> Mongo creds v SSH as mark (password reuse) +- privesc #1 (mark -> tom): a Mongo-driven scheduler runs exec() as tom v privesc #2 (tom -> root): SUID /usr/local/bin/backup -> ret2libc BOF (plus unintended methods) Skills: API enumeration, credential reuse, service abuse through a database, SUID binary analysis (ltrace/Ghidra), ret2libc, NX + ASLR bypass, blacklist filter bypass. ...