Backfire 643
RETIRED MACHINE
Linux
Medium
Backfire
Linux
Medium
3.5
MACHINE RATING3924
USER OWNS3351
SYSTEM OWNS18/01/2025
RELEASEDMachine Synopsis
Backfire is a medium-difficulty box that starts with an exposed Havoc command and control server, where the attacker exploits Server Side Request Forgery to ultimately establish a communication stream to Havoc's WebSocket API and inject malicious commands to get remote code execution in Havoc's payload compile process. Once the attacker gains the initial foothold, another C&C is running locally named Hardhat. The Hardhat C&C is open source, so the attacker crafts a JWT token with the default hardcoded JWT secret key. The user account can execute iptables & iptables-save for privilege escalation, allowing the attacker to achieve arbitrary file write.
Machine Matrix
