Alert 636
RETIRED MACHINE
Linux
Easy
Alert
Linux
Easy
4.3
MACHINE RATING7767
USER OWNS7223
SYSTEM OWNS23/11/2024
RELEASEDMachine Synopsis
Alert is an easy-difficulty Linux machine with a website to upload, view, and share markdown files. The site is vulnerable to cross-site scripting (XSS), which is exploited to access an internal page vulnerable to Arbitrary File Read and leveraged to gain access to a password hash. The hash is then cracked to reveal the credentials leveraged to gain `SSH` access to the target. Enumeration of processes running on the system shows a `PHP` file that is being executed regularly, which has excessive privileges for the management group our user is a member of and allows us to overwrite the file for code execution as root.
Machine Matrix
