I Used an XML Parser to Steal an SSH Private Key — Mustacchio (TryHackMe)

Platform: TryHackMe Difficulty: Easy Category: XXE Injection / SQLite Credential Leak / PATH Hijack Introduction Mustacchio is a barber shop themed box that hides its vulnerabilities with the same care the barber presumably puts into a clean shave — that is to say, not much. An exposed SQLite database in a JS directory, an admin panel on a non-standard port serving raw XML to a parser that trusts…