Chemistry 631
RETIRED MACHINE
Linux
Easy
Chemistry
Linux
Easy
4.4
MACHINE RATING15519
USER OWNS14310
SYSTEM OWNS19/10/2024
RELEASEDMachine Synopsis
Chemistry is an easy-difficulty Linux machine that showcases a Remote Code Execution (RCE) vulnerability in the `pymatgen` (CVE-2024-23346) Python library by uploading a malicious `CIF` file to the hosted `CIF Analyzer` website on the target. After discovering and cracking hashes, we authenticate to the target via SSH as `rosa` user. For privilege escalation, we exploit a Path Traversal vulnerability that leads to an Arbitrary File Read in a Python library called `AioHTTP` (CVE-2024-23334) which is used on the web application running internally to read the root flag.
Machine Matrix
