StrongiTech was breached in March 2024. A quick investigation has been done, the incident was declared remediated and the box went back into production. It has not been updated/modified since, you are the assessor brought in to check that everything is in order.

The strongitech1 host exposes a few services and it still runs the exact software it ran on the day of the breach.

Your mission:

1. Identify the services you will be working against for the rest of the room.
2. Make first contact with the monitoring service and read what it serves.

Work from the outside in. Note what the service is and what it exposes; you will come back to it.

The monitoring service hands back files, and its request handling is where you start. A file server that trusts the path it is given will read whatever you point it at. Turn that into arbitrary read of the host filesystem, and use it to learn who lives on the box.

Your mission:

1. Find and exercise the flaw in how the service resolves the files it serves.
2. Read a file that sits well outside anything the service was meant to expose.
3. Enumerate the accounts on the host and single out the one created during the remediation.

A naive HTTP client will undo the trick for you before the request ever leaves your machine. Make the request say exactly what you mean.

The remediation included rotating a key, and whoever did it was in a hurry.

You will not be handed the key. You will be handed just enough to know when you have rebuilt it.

The replacement key draws its entire entropy from one value the operator assumed nobody could recover. You can. Pin that value down, reconstruct the key, and confirm it against the companion file you already hold. Then render the key in the form your next move will consume.

Your mission:

- Produce the recovered key as the integer the exploitation path expects and cat it.

The software on this box never changed, walk through the hidden door. Your root's channel is blind and severely constrained. Turn that first access into an access you actually control, then collect what the intruder left behind for whoever made it this far.

Your mission:

1. Use the key you previously forged.
2. The execution channel returns nothing and is tightly size-limited; use it to establish durable, interactive root access by other means.
3. Log in for real and read the daily message waiting for you.

You have a tool in your $PATH to help with this specific exploitation technique. It's blind.