Yummy 628
RETIRED MACHINE
Linux
Hard
Yummy
Linux
Hard
4.7
MACHINE RATING1999
USER OWNS1810
SYSTEM OWNS05/10/2024
RELEASEDMachine Synopsis
Yummy is a hard box that starts with a Restaurant web app using Caddy web service, on port 80, where an attacker finds an arbitrary file read HTTP Location header, which is not handled and sanitized properly by default Caddy default configuration. Reading the source code, the web app uses JWT RSA keypairs to forge an admin token and escalate privileges on the web app. The admin panel has an SQL injection, allowing arbitrary file write, the attacker now overwrites a file running periodically (`cronjob`). Improper directory permissions allow the attacker to move laterally to `www-data` and eventually `dev` user. The `dev` user can execute `rsync` binary as root, which helps escalate privileges to root.
Machine Matrix