https://john-jkar.github.io/myblog/tags/labs/Recent content in Labs on 4mN3s14 | BlogHugoenTue, 02 Jun 2026 00:00:00 +0000https://john-jkar.github.io/myblog/posts/quart_lock/Tue, 02 Jun 2026 00:00:00 +0000https://john-jkar.github.io/myblog/posts/quart_lock/<h1 id="quartzlock-vulnyx-writeup">QuartzLock VulNyx: Writeup</h1> <h2 id="target-summary">Target Summary</h2> <table> <thead> <tr> <th>Item</th> <th>Value</th> </tr> </thead> <tbody> <tr> <td>Target</td> <td><code>192.168.100.143</code></td> </tr> <tr> <td>Primary hostname</td> <td><code>quartz.nyx</code></td> </tr> <tr> <td>Additional hosts</td> <td><code>api.nyx</code>, <code>enroll.nyx</code></td> </tr> <tr> <td>Initial execution</td> <td><code>svc-attest</code></td> </tr> <tr> <td>User foothold</td> <td><code>caden</code></td> </tr> <tr> <td>Root mechanism</td> <td><code>qctl replay</code> plugin overlay</td> </tr> <tr> <td>User flag</td> <td><code>939dedafdb8d309b2d71c4f482210672</code></td> </tr> <tr> <td>Root flag</td> <td><code>16760b5a8e71fb62499088b89ac255b5</code></td> </tr> </tbody> </table> <h2 id="attack-chain">Attack Chain</h2> <ol> <li>Discover <code>api.nyx</code> and <code>enroll.nyx</code> in the TLS certificate.</li> <li>Abuse duplicate JSON <code>scope</code> keys to obtain a privileged JWT.</li> <li>Upload a qpak containing a double-encoded WASI preopen traversal.</li> <li>Reach <code>/run/quartz/worker.sock</code> and invoke <code>RunLegacyProbe</code>.</li> <li>Execute commands as <code>svc-attest</code>.</li> <li>Abuse wildcard asset matching in <code>qcert</code> to obtain an SSH certificate for <code>caden</code>.</li> <li>SSH as <code>caden</code> and read the user flag.</li> <li>Abuse the <code>qctl replay</code> namespace overlay to execute a case plugin as root.</li> <li>Read the root flag.</li> </ol> <h2 id="requirements">Requirements</h2> <p>The attacking system needs:</p>