https://appl3b0y.com/tags/helpdeskz/ Recent content in Helpdeskz on appl3b0y Hugo en-us Thu, 04 Jun 2026 00:00:00 +0000 https://appl3b0y.com/writeups/help/ Thu, 04 Jun 2026 00:00:00 +0000 https://appl3b0y.com/writeups/help/ <h2 id="introduction">Introduction</h2> <p><strong>Help</strong> is an easy Linux box, but it packs in more real-world lessons than most: a <strong>GraphQL</strong> endpoint that leaks credentials through introspection, a <strong>HelpDeskZ 1.0.2</strong> install with two known bugs whose public exploits are both broken (so you fix them yourself), a bit of <strong>password reuse</strong>, and an old <strong>kernel</strong> that falls to a public CVE.</p> <p>The path: port 3000 runs a Node/Express GraphQL API that all but invites you to query it, and doing so leaks an MD5 hash we crack. Those credentials log us into the HelpDeskZ ticketing app on port 80. HelpDeskZ 1.0.2 has both an authenticated <strong>SQL injection</strong> and an <strong>arbitrary file upload</strong>; the Exploit-DB PoCs for both fail on modern Python, so the real work is reading them and reproducing them manually. The SQLi dumps an admin password that is <strong>reused</strong> for SSH as <code>help</code>, and the file upload gives a shell directly. Either way we land as <code>help</code>, and the ancient <strong>4.4.0-116</strong> kernel gives up root to <strong>CVE-2017-16995</strong>.</p>