ALA
LOGHMARI

HackTheBox: DutyBound

DutyBound, a Medium-rated Linux machine from HackTheBox, involved exploiting a SQL Injection in a BCBP (Bar Coded Boarding Pass) parser to gain RCE as the postgres user. We then leveraged X11 keystroke injection via python-xlib to escalate to the dutyfree-kiosk user. Finally, we abused a systemd path unit that triggers a bash script with an eval injection to achieve root.