Soccer

Mon, 08 Jun 2026 00:00:00 +0000

Introduction

Soccer is an easy Linux box that moves through three distinct users, and each hop teaches something different: a default-credentials web RCE, a SQL injection delivered over a WebSocket (the part that makes this box memorable), and a doas/dstat plugin hijack for root.

We start by finding a Tiny File Manager install with the vendor’s default admin login, which gives an authenticated file upload and therefore a shell as www-data. On the host, the nginx config points us to a second virtual host whose signup flow talks to a WebSocket on port 9091 (the odd port nmap could not fingerprint). That WebSocket takes a JSON id straight into a query, so a blind SQL injection dumps the player account’s password, which is reused for SSH. Finally, player can run dstat as root via doas, and dstat loads Python plugins from a world-writable directory, so we drop a malicious plugin and it runs as root.

Help

Thu, 04 Jun 2026 00:00:00 +0000

Introduction

Help is an easy Linux box, but it packs in more real-world lessons than most: a GraphQL endpoint that leaks credentials through introspection, a HelpDeskZ 1.0.2 install with two known bugs whose public exploits are both broken (so you fix them yourself), a bit of password reuse, and an old kernel that falls to a public CVE.

The path: port 3000 runs a Node/Express GraphQL API that all but invites you to query it, and doing so leaks an MD5 hash we crack. Those credentials log us into the HelpDeskZ ticketing app on port 80. HelpDeskZ 1.0.2 has both an authenticated SQL injection and an arbitrary file upload; the Exploit-DB PoCs for both fail on modern Python, so the real work is reading them and reproducing them manually. The SQLi dumps an admin password that is reused for SSH as help, and the file upload gives a shell directly. Either way we land as help, and the ancient 4.4.0-116 kernel gives up root to CVE-2017-16995.

File-Upload on appl3b0y

Soccer

Introduction

Help

Introduction