I’ll take advantage of two mistakes in the coding to write a binary that escapes the jail and reads the database for the application, including the Django admin password. In the source, I’ll see how the sandbox sets up chroot jails to isolate the malware. The source for the site and the sandbox is also downloadable. The box starts with a website that is kind of like VirusTotal, where users can upload executables (Linux only) and they run, and get back a list of system calls and return values.
The entire Scanned challenge is focused on a single web application, and yet it’s one of the hardest boxes HackTheBox has published. Ctf hackthebox htb-scanned nmap django source-code chroot jail sandbox-escape makefile ptrace fork dumbable c python youtube hashcat shared-object
0 kommentar(er)
