Brief
SSHole (CVE-2026-123158): a locked account accepts a password over SSH, on a stock OpenSSH + Alpine (musl) box, which delivers an authentication-logic bug for years. This chamber walks you through it one step at a time so you see why it works.
You start as bob (password correct-horse-battery). Two other accounts, alice
and root, are locked with * in /etc/shadow and should never accept a password.
Four flags, scored separately:
- Foothold — log in as bob and read
~/flag1. - The 256-byte wall — run
/opt/sshole/crypt-oracle(pipe a password to its stdin) and make musl'scrypt()fail. It explains itself and hands you the flag. - The bypass — log in over SSH as the locked account alice.
- Blast radius — the same trick logs you in as root.
Everything you need is on the box. Capture flags in form of DAEDALUS{...} to pwn the chamber.