Dead Point

Platform: hackerlab | Category: Pentest | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-04-16 | Status: Solved Techniques: smtp_credential_discovery, flask_session_authentication, idor_enumeration, credential_reuse, sudo_path_traversal, encrypted_file_decryption

Summary

Task: compromise a pentest host exposing SMTP, a Flask blog, and SSH. Solution: discover valid mail credentials, abuse an authenticated IDOR to recover SSH access, then exploit a sudo-approved OpenSSL wrapper with path traversal to decrypt the final flag fragment from root.

Dead Point — Hackerlab

Description

Мертвая точка

English summary: the target exposed SSH, SMTP, and a Flask-based blog. The path to the flag was a chained compromise: mail credential discovery, authenticated access to hidden blog content, SSH login, and a sudo misconfiguration that allowed reading a protected root file through an OpenSSL wrapper.

Recon

Initial reconnaissance identified the attack surface on 192.168.2.212:

• 22/tcp — SSH
• 25/tcp — SMTP
• 80/tcp — HTTP

The web server identified itself as Werkzeug/3.1.3 Python/3.12.10, and the site redirected / to /blog?id=1. The first public blog post showed the author s_joshua, while /blog?id=2 was inaccessible before authentication. That strongly suggested a second, hidden post and made the blog ID parameter a likely IDOR target after login. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Foothold

The visible username on the blog provided the first identity clue. Combining it with the discovered host name deadpoint.cdb produced a likely mailbox:

• s_joshua@deadpoint.cdb

SMTP authentication was enabled, and the valid password was recovered as:

• s_joshua@deadpoint.cdb / klaster

Those same credentials worked on the web application and issued a valid Flask session cookie. Once authenticated, the hidden post at /blog?id=2 became accessible and exposed internal credentials:

• username: joshua
• password: 2RRTCA43JMH156 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Reusing them over SSH gave the initial shell as joshua.

The first part of the flag was stored locally:

 text read-only • copy allowed Copy
CODEBY{REDACTED

Privilege Escalation

The key privilege-escalation lead came from sudo -l:

 bash read-only • copy allowed Copy
(root) NOPASSWD: /opt/encrypt_log.sh /var/log/apache2/*

The allowed script encrypted any provided file with OpenSSL and printed the result:

 bash read-only • copy allowed Copy
openssl enc -aes-256-cbc -salt -in "$FILE" -out "$ENCRYPTED_FILE" -k CODEBY

This looked restricted to Apache logs, but the argument check trusted the /var/log/apache2/* prefix. That made directory traversal possible by supplying a path that still matched the allowed pattern while escaping into /root. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The working payload was:

 bash read-only • copy allowed Copy
sudo /opt/encrypt_log.sh /var/log/apache2/../../../root/last_part | openssl enc -d -aes-256-cbc -k CODEBY

That returned the second flag fragment:

 text read-only • copy allowed Copy
REDACTED}

Combining both parts produced the final flag.

Final Flag

 text read-only • copy allowed Copy
CODEBY{REDACTED}

Lessons / Indicators

Use this pattern when you see:

• A public post reveals a likely username and the target exposes SMTP AUTH.
• A web application uses numeric object IDs and some records become visible only after login.
• Recovered credentials from one service are likely reusable on SSH.
• sudo -l allows a script on a wildcard path such as /var/log/apache2/*.
• A privileged wrapper reads attacker-controlled files and uses a reversible command like openssl enc with a hardcoded key. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Full Attack Chain

 text read-only • copy allowed Copy
Recon → Blog author enumeration → SMTP credential discovery
     → Web login → Authenticated IDOR on /blog?id=2
     → SSH as joshua → sudo wildcard path traversal
     → OpenSSL decryption of root file → full flag

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍