Boolean Writeup - Proving Grounds
Created October 8, 2026 • Last updated October 8, 2026 • 2 min read
Boolean runs a Ruby on Rails application with a built-in file manager. A mass assignment flaw in the email-change endpoint bypasses email confirmation to unlock the file manager, whose local file inclusion is used to browse the filesystem and plant an SSH key for a foothold. A root SSH private key left in the user's home directory gives privilege escalation.
Reconnaissance
Nmap
Scan all ports.
22/tcp open ssh OpenSSH 7.9p1 Debian 80/tcp open http Boolean web app (Rails) 33017/tcp open http Apache httpd (static "Development" page)
Port 80 runs a Rails app: tell-tale signs are the .rails-default-error-page CSS class, a _boolean_session cookie, and an authenticity_token CSRF parameter. It exposes registration, login, and a file manager feature gated behind email confirmation. Port 33017 is a static placeholder page and a dead end.
Exploitation
Email confirmation bypass (mass assignment)
Register an account, then intercept the email-change request in Burp Suite. The endpoint uses a _method=patch override and blindly mass-assigns every submitted user parameter, including confirmed.
POST /settings/email HTTP/1.1
Host: $TARGET_IP
Cookie: _boolean_session=<session cookie>
Content-Type: application/x-www-form-urlencoded
_method=patch&authenticity_token=<token>&user%5Bconfirmed%5D=True&user%5Bemail%5D=husky%40email.com&commit=Change+emailThe server responds 200 OK with confirmed: true, and refreshing the page unlocks the file manager.
LFI to filesystem browsing
The file manager exposes a local file inclusion via the cwd and file parameters.
root:x:0:0:root:/root:/bin/bash <snip> remi:x:1000:1000:remi,,,:/home/remi:/bin/bash
The user remi has a home directory. Generate an SSH keypair, then use the LFI to browse to /home/remi/.ssh/ and upload the public key as authorized_keys through the file manager's upload feature.
remi@BooleanOne:~$ id uid=1000(remi) gid=1000(remi) groups=1000(remi)
Explain command
| -i | Use this private key for authentication. |
Shell as remi. Check the home directory for anything interesting.
Privilege Escalation
Root SSH key in the user's keystore
An extra key store at ~/.ssh/keys/ holds a private key named root.
root@BooleanOne:~# id uid=0(root) gid=0(root) groups=0(root)
Related
Local File Inclusion Exploitation
Exploit LFI vulnerabilities to read sensitive files, achieve log poisoning, and escalate to RCE via...
LFI to Remote Code Execution
Exploit Local File Inclusion vulnerabilities to achieve RCE via log poisoning, PHP wrappers, /proc/s...
Linux SSH Authorized Keys Persistence
Covers abusing SSH authorized_keys files to maintain persistent backdoor access on Linux systems by...
SSH Private Key Discovery and Passphrase Cracking
Locate SSH private keys on compromised hosts, extract them, and crack passphrases offline using John...