Summary
Forgotten is a HckTheBox machine centered around an exposed LimeSurvey installer endpoint that was never properly secured post-deployment. By spinning up a rogue MySQL server, an attacker can hijack the installation process to create a fresh admin account on the target's LimeSurvey instance. From there, a known RCE vulnerability (CVE-2021-44967) in LimeSurvey's plugin upload feature grants a foothold inside a Docker container. Environment variable leakage exposes the container user's password, allowing lateral movement to the host OS via SSH. Finally, a mounted Docker volume shared between the container and the host enables a classic SUID bash privilege escalation to achieve root on the underlying system.
Reconnaissance
Port Scan
nmap -sC -sV -A <MACHINE-IP> -oA nmap
