Skip to content

Jarvis — Credentials

User Password/Hash Type Source Access Granted Tested
DBadmin (hash in mysql.user, not needed) MySQL account user() via SQLi DB access w/ FILE priv → OUTFILE webshell ✓
www-data — (webshell) Linux service acct INTO OUTFILE webshell RCE, sudo -u pepper simpler.py ✓
pepper SSH private key (loot/pepper.key) SSH key self-generated via simpler.py injection SSH login, user.txt ✓
root — Linux root malicious systemd unit via sudo systemctl full root, root.txt ✓

Flags

  • user.txt: e9d237221e586eb5218da98fc80fcf55
  • root.txt: 3a72bb5d8b34634df1167e828c9aa750

Notes

  • DBadmin's MySQL hash was never needed — the FILE privilege alone gave RCE via INTO OUTFILE.
  • pepper's SSH key was generated by us (not stolen): inside the $(bash) shell as pepper we ran ssh-keygen, appended the pubkey to ~/.ssh/authorized_keys, and exfiltrated the private key for stable SSH.
  • No password reuse leveraged; every step was a capability/misconfig abuse, not credential cracking.