Perfection 590
RETIRED MACHINE
Linux
Easy
Perfection
Linux
Easy
4.2
MACHINE RATING12128
USER OWNS11230
SYSTEM OWNS02/03/2024
RELEASEDMachine Synopsis
Perfection is an easy Linux machine that features a web application with functionality to calculate student scores. This application is vulnerable to Server-Side Template Injection (SSTI) via regex filter bypass. A foothold can be gained by exploiting the SSTI vulnerability. Enumerating the user reveals they are part of the `sudo` group. Further enumeration uncovers a database with password hashes, and the user's mail reveals a possible password format. Using a mask attack on the hash, the user's password is obtained, which is leveraged to gain `root` access.
Machine Matrix