Jarvis — Credentials¶
| User | Password/Hash | Type | Source | Access Granted | Tested |
|---|---|---|---|---|---|
| DBadmin | (hash in mysql.user, not needed) | MySQL account | user() via SQLi |
DB access w/ FILE priv → OUTFILE webshell |
✓ |
| www-data | — (webshell) | Linux service acct | INTO OUTFILE webshell |
RCE, sudo -u pepper simpler.py |
✓ |
| pepper | SSH private key (loot/pepper.key) |
SSH key | self-generated via simpler.py injection | SSH login, user.txt | ✓ |
| root | — | Linux root | malicious systemd unit via sudo systemctl |
full root, root.txt | ✓ |
Flags¶
- user.txt:
e9d237221e586eb5218da98fc80fcf55 - root.txt:
3a72bb5d8b34634df1167e828c9aa750
Notes¶
- DBadmin's MySQL hash was never needed — the
FILEprivilege alone gave RCE viaINTO OUTFILE. - pepper's SSH key was generated by us (not stolen): inside the
$(bash)shell as pepper we ranssh-keygen, appended the pubkey to~/.ssh/authorized_keys, and exfiltrated the private key for stable SSH. - No password reuse leveraged; every step was a capability/misconfig abuse, not credential cracking.