https://appl3b0y.com/tags/git/ Recent content in Git on appl3b0y Hugo en-us Tue, 02 Jun 2026 00:00:00 +0000 https://appl3b0y.com/writeups/busqueda/ Tue, 02 Jun 2026 00:00:00 +0000 https://appl3b0y.com/writeups/busqueda/ <h2 id="introduction">Introduction</h2> <p><strong>Busqueda</strong> is an easy Linux box that plays out like a small, realistic engagement: one web bug for the foothold, then a chain of information leaks and a <code>sudo</code> misconfiguration for root. No memory corruption, just reading things carefully.</p> <p>The foothold is an <strong><code>eval()</code> injection</strong> in <strong>Searchor 2.4.0</strong>, the library powering the search site. That gives a shell as <code>svc</code>. From there the box is about looting: a leftover <code>.git/config</code> exposes a Gitea instance and a set of credentials, and a <code>sudo</code>-runnable &ldquo;system checkup&rdquo; script lets us inspect Docker containers, one of which leaks a database password. That password is <strong>reused</strong> for the Gitea admin, which lets us read the source of the very script we can run as root. The script calls a helper by a <strong>relative path</strong>, so we drop our own version in the working directory and run it as root.</p>