Rce on appl3b0y

Broker

Thu, 04 Jun 2026 00:00:00 +0000

Introduction

Broker is an easy Linux box built around a single, very topical vulnerability: CVE-2023-46604, the Apache ActiveMQ OpenWire remote code execution bug that made a lot of noise in late 2023. It is a clean, two-step machine: get RCE on the message broker, then abuse one over-permissive sudo rule to become root.

The foothold is almost handed to us. The ActiveMQ web console uses default admin:admin credentials, which is enough to read the exact version (5.15.15) and confirm it is vulnerable. From there, the OpenWire protocol on 61616 lets us trigger a deserialization gadget that makes the broker fetch and execute a remote Spring XML, which runs our payload and returns a shell as the activemq user. Privesc is a textbook GTFOBins move: activemq can run nginx under sudo, so we start a root-owned nginx with WebDAV PUT enabled and simply write our SSH key into /root/.ssh/authorized_keys.

Busqueda

Tue, 02 Jun 2026 00:00:00 +0000

Introduction

Busqueda is an easy Linux box that plays out like a small, realistic engagement: one web bug for the foothold, then a chain of information leaks and a sudo misconfiguration for root. No memory corruption, just reading things carefully.

The foothold is an eval() injection in Searchor 2.4.0, the library powering the search site. That gives a shell as svc. From there the box is about looting: a leftover .git/config exposes a Gitea instance and a set of credentials, and a sudo-runnable “system checkup” script lets us inspect Docker containers, one of which leaks a database password. That password is reused for the Gitea admin, which lets us read the source of the very script we can run as root. The script calls a helper by a relative path, so we drop our own version in the working directory and run it as root.

Tue, 02 Jun 2026 00:00:00 +0000

Introduction

Sau is an easy Linux box, and it is a very clean example of chaining three small, well-scoped bugs into root. Nothing here needs a custom exploit or memory corruption; each stage is “known software at a known vulnerable version”.

The chain: the only web app we can reach is Request Baskets 1.2.1, which has an SSRF (CVE-2023-27163). We use that SSRF to punch through the firewall and reach a port that nmap reported as filtered. Behind that port sits Maltrail v0.53, which has a trivial unauthenticated command injection in its login page, giving us a shell as puma. Finally, puma is allowed to run systemctl status under sudo, and because systemctl pipes long output through the less pager, we drop into a root shell with a single !sh.