Htb — Dark Runes

It reads a file, XOR-decrypts it with a hardcoded key, then executes the output as a shell command if it starts with RUNECMD: . Create a malicious rune file:

Machine Difficulty: Medium Category: Web, Cryptography, Binary Exploitation, Linux htb dark runes

✅ RCE achieved. Get a reverse shell:

User flag: user.txt in /home/admin . Run sudo -l → (root) NOPASSWD: /usr/local/bin/rune_decoder /var/runes/* It reads a file, XOR-decrypts it with a

Land in /var/www/darkrunes . Find config.py with PostgreSQL creds: db_user: rune_walker , db_pass: s3cr3t_run3s . Access DB: It reads a file