~ / writeups / vault

Vault

OffSec Playground — NFS misconfiguration to credential theft.

Recon

An exported NFS share is world-readable and contains user home directories.

Exploitation

Mount the share, read an SSH key, and log in. Escalate via a writable cron script.