TwoMillion

Author: 0xIDA

Summary

Easy free/retired Linux. Invite API → register → mass-assign admin → VPN generate command injection → .env reuse → CVE-2023-0386 OverlayFS/FUSE root.

Chain

1. Deobfuscate /js/inviteapi.min.js → generate/verify invite → register/login
2. PUT /api/v1/admin/settings/update with {"email":"...","is_admin":1}
3. POST /api/v1/admin/vpn/generate {"username":"x;cmd #"} as www-data
4. /var/www/html/.env → SSH admin / SuperDuperPass123
5. CVE-2023-0386 on kernel 5.15.70 (FUSE lower + overlay copy-up SUID)

Solvers

• web_foothold.py

Flags

user: 59ef2074a5115cf2cf9981f404c12892
root: 4e2a83bbf8ff141015252c50ac797764