BlockBlock
Linux
Hard
3.3
MACHINE RATING854
USER OWNS769
SYSTEM OWNS16/11/2024
RELEASEDMachine Synopsis
BlockBlock is a hard-difficulty Linux machine hosting a decentralized chat application built on a blockchain with two primary smart contracts: `Users.sol` and `Database.sol`. The application includes a "Report User" functionality vulnerable to XSS, which can be exploited to steal the admin's token via an exposed API endpoint. Gaining admin access allows us to retrieve the authorization token needed to interact with the blockchain's `/api/json-rpc` endpoint. By enumerating transaction blocks, we extract credentials for user `keira`. Privilege escalation to user `paul` is achieved by leveraging `keira`'s `sudo` permissions to execute the Forge CLI tool as `paul`. Finally, `paul` has root access to the `pacman` package manager, which can be exploited via the post-install hook feature to execute arbitrary commands as root.
Machine Matrix
