Strutted 644
RETIRED MACHINE
Linux
Medium
Strutted
Linux
Medium
4.6
MACHINE RATING205
USER OWNS202
SYSTEM OWNS23/01/2025
RELEASEDMachine Synopsis
`Strutted` is an medium-difficulty Linux machine featuring a website for a company offering image hosting solutions. The website provides a Docker container with the version of Apache Struts that is vulnerable to `[CVE-2024-53677](https://nvd.nist.gov/vuln/detail/CVE-2024-53677)`, which is leveraged to gain a foothold on the system. Further enumeration reveals the `tomcat-users.xml` file with a plaintext password used to authenticate as `james`. For privilege escalation, we abuse `tcpdump` while being used with `sudo` to create a copy of the `bash` binary with the `SUID` bit set, allowing us to gain a `root` shell.
Machine Matrix