Lame as its name suggests is a very easy box. The services running on the box are old, and there is a known CVE that allows to directly gain a shell as root.

In DC-9, we only have access to a web application, which is vulnerable to SQL injection and LFI. We exploit the SQL injection to collect a set of credentials that is used later on in the box. The interesting part of this box is that it uses port knocking to “hide” the SSH service. We leverage the LFI to find the specific port sequence, and after opening the port, we perform a password spray to get valid users. In root, one of the users is able to run a binary as root, which allows us to add ourselves as root by writing to the /etc/passwd file.

FALL is an easy box from the digitalworld.local series. It hosts a web application that uses CMS Made Simple, where we discover an LFI vulnerability that allows us to read the SSH private key of the user on the box. Then, we find the user’s credentials in their bash history, which allows us to run sudo. The user had run ALL privileges on the box, so we jump straight to root.