Box: Legacy Admin Panel (chained)
box · hard · +120 XP
// what is Box: Legacy Admin Panel (chained)?
Multi-step chained exploitation — real engagements rarely come down to one bug. You discover via info-disclosure (robots.txt, comments, JS bundles), bypass auth (SQLi, default creds), then escalate via the post-auth attack surface (file-read, command-exec, deserialization). The chain is the skill: a single low-impact bug becomes critical when you chain it with two more.
// how attackers detect it
- [01]Always read
/robots.txt,/.git/HEAD,/.env,/sitemap.xml, source-map URLs in JS bundles. - [02]Dirbust hidden paths —
ffuf -w common.txt. Look for/admin-old,/v1/,/legacy/. - [03]Once authenticated to the admin panel, audit every endpoint — file viewers, SQL consoles, upload forms.
// how defenders prevent it
- ✓Defense in depth — don't rely on a single layer. Auth + authz + WAF + monitoring.
- ✓Remove legacy code paths. If
/admin-oldexists 'just in case', it WILL be exploited. - ✓Read-only admin operations on production; no file-read primitives in customer-facing dashboards.
// real-world incidents
CVE-2023-42793
TeamCity auth bypass + RCE chain
Single-vendor multi-step chain — APT29 used it.
CVE-2024-21887
Ivanti Connect Secure chain
Command injection chained with auth bypass, mass-exploited 2024.
// hands-on tips for this lab
- ›Step 1:
GET /robots.txt→ reveals/admin-old/. Step 2: SQLi' OR 1=1--on login. Step 3:/admin-old/file?name=/root/flag.txt.
was this lesson helpful?
// start of box
next
Box: Cloud Misconfig (S3 + IAM + SSRF)
1 of 9 · box