Help

Thu, 04 Jun 2026 00:00:00 +0000

Introduction

Help is an easy Linux box, but it packs in more real-world lessons than most: a GraphQL endpoint that leaks credentials through introspection, a HelpDeskZ 1.0.2 install with two known bugs whose public exploits are both broken (so you fix them yourself), a bit of password reuse, and an old kernel that falls to a public CVE.

The path: port 3000 runs a Node/Express GraphQL API that all but invites you to query it, and doing so leaks an MD5 hash we crack. Those credentials log us into the HelpDeskZ ticketing app on port 80. HelpDeskZ 1.0.2 has both an authenticated SQL injection and an arbitrary file upload; the Exploit-DB PoCs for both fail on modern Python, so the real work is reading them and reproducing them manually. The SQLi dumps an admin password that is reused for SSH as help, and the file upload gives a shell directly. Either way we land as help, and the ancient 4.4.0-116 kernel gives up root to CVE-2017-16995.

Busqueda

Tue, 02 Jun 2026 00:00:00 +0000

Introduction

Busqueda is an easy Linux box that plays out like a small, realistic engagement: one web bug for the foothold, then a chain of information leaks and a sudo misconfiguration for root. No memory corruption, just reading things carefully.

The foothold is an eval() injection in Searchor 2.4.0, the library powering the search site. That gives a shell as svc. From there the box is about looting: a leftover .git/config exposes a Gitea instance and a set of credentials, and a sudo-runnable “system checkup” script lets us inspect Docker containers, one of which leaks a database password. That password is reused for the Gitea admin, which lets us read the source of the very script we can run as root. The script calls a helper by a relative path, so we drop our own version in the working directory and run it as root.

Password-Reuse on appl3b0y

Help

Introduction

Busqueda

Introduction