https://appl3b0y.com/tags/request-baskets/ Recent content in Request-Baskets on appl3b0y Hugo en-us Tue, 02 Jun 2026 00:00:00 +0000 https://appl3b0y.com/writeups/sau/ Tue, 02 Jun 2026 00:00:00 +0000 https://appl3b0y.com/writeups/sau/ <h2 id="introduction">Introduction</h2> <p><strong>Sau</strong> is an easy Linux box, and it is a very clean example of chaining three small, well-scoped bugs into root. Nothing here needs a custom exploit or memory corruption; each stage is &ldquo;known software at a known vulnerable version&rdquo;.</p> <p>The chain: the only web app we can reach is <strong>Request Baskets 1.2.1</strong>, which has an <strong>SSRF</strong> (CVE-2023-27163). We use that SSRF to punch through the firewall and reach a port that nmap reported as <code>filtered</code>. Behind that port sits <strong>Maltrail v0.53</strong>, which has a trivial <strong>unauthenticated command injection</strong> in its login page, giving us a shell as <code>puma</code>. Finally, <code>puma</code> is allowed to run <code>systemctl status</code> under <code>sudo</code>, and because <code>systemctl</code> pipes long output through the <code>less</code> pager, we drop into a root shell with a single <code>!sh</code>.</p>