themursalin/cozyhosting_walkthrough

CozyHosting_Walkthrough is an educational security assessment writeup documenting a step by step penetration test of a fictional hosting company's Spring Boot (Java) web application. It is classified as an educational walkthrough demonstrating real world attack techniques in a deliberately vulnerable environment, similar to the format used by hands on security training labs. The walkthrough covers a complete attack chain. First, port scanning identifies open services. The application is found to expose Spring Boot Actuator endpoints, operational debugging paths often left enabled by accident in production. The /actuator/sessions endpoint leaks active session identifiers and their associated usernames. Replacing the browser session cookie with a stolen ID takes over an authenticated user's session without a password, a session hijacking attack. From the admin dashboard, a form that runs SSH commands is found vulnerable to command injection: an attacker can append arbitrary shell commands to the username field. Space characters are filtered, but the walkthrough shows bypass techniques using shell features. A reverse shell is established this way, giving the attacker interactive access to the server. Inside the application, the JAR file (a packaged Java archive) contains a configuration file with PostgreSQL database credentials in plaintext. The database yields password hashes for two accounts. The admin hash is cracked using hashcat with the rockyou.txt wordlist. The cracked password also works for a local system user, enabling lateral movement. Finally, a misconfigured sudo rule lets that user run ssh as root, and the SSH ProxyCommand option is abused to spawn a root shell. The full README is longer than what was shown.