Haircut 21
RETIRED MACHINE
Linux
Medium
Haircut
Linux
Medium
4.8
MACHINE RATING6035
USER OWNS5054
SYSTEM OWNS26/05/2017
RELEASEDMachine Synopsis
Haircut is a medium-difficulty Linux machine, featuring several useful attack vectors. The challenge begins with web enumeration, where a PHP site invoking `curl` is discovered. Parameter injection is leveraged to write a webshell to the server, allowing for code execution. Further enumeration of the filters enables command execution directly within the page. For privilege escalation, a vulnerable version of `screen` with SUID permissions is identified and exploited to achieve `root` access.
Machine Matrix