Shibboleth 410
RETIRED MACHINE
Linux
Medium
Shibboleth
Linux
Medium
4.8
MACHINE RATING4788
USER OWNS4541
SYSTEM OWNS13/11/2021
RELEASEDMachine Synopsis
Shibboleth is a medium difficulty Linux machine featuring IPMI and Zabbix software. IPMI authentication is found to be vulnerable to remote password hash retrieval. The hash can be cracked and Zabbix access can be obtained using these credentials. Foothold can be gained by abusing the Zabbix agent in order to run system commands. The initial password can be re-used to login as the `ipmi-svc` and acquire the user flag. A MySQL service is identified and found to be vulnerable to OS command execution. After successfully exploiting this service a root shell is gained.
Machine Matrix