Soccer

Mon, 08 Jun 2026 00:00:00 +0000

Introduction

Soccer is an easy Linux box that moves through three distinct users, and each hop teaches something different: a default-credentials web RCE, a SQL injection delivered over a WebSocket (the part that makes this box memorable), and a doas/dstat plugin hijack for root.

We start by finding a Tiny File Manager install with the vendor’s default admin login, which gives an authenticated file upload and therefore a shell as www-data. On the host, the nginx config points us to a second virtual host whose signup flow talks to a WebSocket on port 9091 (the odd port nmap could not fingerprint). That WebSocket takes a JSON id straight into a query, so a blind SQL injection dumps the player account’s password, which is reused for SSH. Finally, player can run dstat as root via doas, and dstat loads Python plugins from a world-writable directory, so we drop a malicious plugin and it runs as root.

Doas on appl3b0y

Soccer

Introduction