Шахматы (Chess) — GAMBIT

hackerlab

Task: Windows AD DC (codeby.cdb / GAMBIT) exposing an aiohttp 3.8.0 web app on a non-default vhost. Solution: exploit CVE-2024-23334 path traversal (follow_symlinks) via curl --path-as-is to read source and leak FTP creds, pivot to SMB as a domain user for the user flag, then extract the Administrator password from a procdump memory dump (base64 $enc_pass) to read the root flag.

active_directory aiohttp base64 codeby credential_extraction cve_2024_23334 hackerlab lfi memory_dump path_traversal privilege_escalation procdump pyftpdlib smb virtual_host

aiohttp_follow_symlinks_traversalbase64_decodehardcoded_credential_leakprocdump_memory_string_extractionsmb_enumeration_domain_credssource_code_disclosurevertical_privilege_escalationvhost_discovery_host_header

$ ls tags/ techniques/

active_directory aiohttp base64 codeby credential_extraction cve_2024_23334 hackerlab lfi memory_dump path_traversal privilege_escalation procdump pyftpdlib smb virtual_host

$ cat /etc/rate-limit

Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.

Шахматы (Chess) — GAMBIT (hackerlab)

Description

Шахматы. В цейтнот попадает не тот, кто много думает, а тот, кто думает не о том.

English: "Chess. Time trouble (цейтнот) befalls not the one who thinks a lot, but the one who thinks about the wrong thing."

This is deliberate misdirection. "Цейтнот" (time trouble) lures solvers toward Kerberos / time-based attacks (AS-REP roast, Kerberoast, user enumeration) against the domain controller. The real foothold is a web CVE — "think about the right thing."

Target: 192.169.2.16, Windows Domain Controller, domain codeby.cdb, host GAMBIT. Flag format CODEBY{...}. The flag is split across the user flag and the root flag.

Analysis

Recon

Full TCP scan shows a classic AD surface plus one odd port:

53, 88, 135, 139, 389, 445, 464, 593, 636, 3268, 3269, 9389 — Active Directory / DC services
5985 — WinRM
31337 — a web service
21 and 80 — connection refused

The web service on 31337 is a virtual host: it only answers when the HTTP Host header is gambit. With a default host the connection hangs/times out.

curl -s -H "Host: gambit" http://192.169.2.16:31337/
# -> "Welcome to Gambit server!"
# Response headers include:
#   Server: Python/3.10 aiohttp/3.8.0
#   Channel: @wh_lab

aiohttp/3.8.0 is the key signal: it is vulnerable to CVE-2024-23334 — directory traversal in static routes configured with follow_symlinks=True (fixed in 3.9.2).

Solution

Step 1 — CVE-2024-23334 path traversal (arbitrary file read)

aiohttp serves a static route. If that route is registered with follow_symlinks=True, the path normalization that should confine requests to the static directory is bypassed, allowing ../ traversal.

Exploitation details that mattered:

...