Writer 361
RETIRED MACHINE
Linux
Medium
Writer
Linux
Medium
4.5
MACHINE RATING3790
USER OWNS3014
SYSTEM OWNS31/07/2021
RELEASEDMachine Synopsis
Writer is a medium Linux machine that outlines poor coding practices and presents how a file read vulnerability through SQL injection can lead to disclosure of source code files which include credentials. The combination of password reuse on the SMB service with a blind SSRF exploitation via an image upload function can lead to a foothold on the system. By abusing Django features it is possible to extract and crack user credentials. Further abusing multiple misconfigurations in Postfix service leads to exploit privileges in the apt service folders allowing those users to execute commands as root through a script that updates the machine every minute.
Machine Matrix