Machine Synopsis

RE is a hard difficulty Linux machine, featuring analysis of ODS documents using Yara. A maliciously crafted document can be used to evade detection and gain a foothold. The box uses an old version of WinRAR, which is vulnerable to path traversal. This is exploited to drop a shell to the web root and land a shell as the IIS user who has write access to the project folder. A Ghidra project is then uploaded to the folder to exploit XXE and steal admin hashes.