# Dropping root shell in a Crypto Exchange for Fun and Profitn't

Unauthenticated Argo Workflows dashboard on a staging EKS host allowed creating a malicious workflow that yielded a root shell in the container.

- Payout: $1,000
- Severity: critical
- Program: ChangeNOW
- Credited: Nirmal Thapa
- Disclosed: 2021-08-31
- Write-up quality: 6/10
- Original: https://www.tnirmal.com.np/2021/08/dropping-root-shell-in-crypto-exchange.html
- Library page: https://bugbountylibrary.com/r/blog%3Atnirmal-com-np-2021-08-dropping-root-shell-in-crypto-exchange-html
- Tags: domain:cloud impact:internal-access impact:rce kind:bounty platform:blog sev:critical tech:aws tech:kubernetes technique:chained technique:recon vuln:auth-bypass vuln:misconfiguration vuln:rce

**Target:** Argo Workflows dashboard on staging EKS subdomain
**Root cause:** Argo Workflows dashboard exposed without authentication, allowing arbitrary workflow creation; workflow pods run privileged/root and permit container escape.
**Steps:**
1. Enumerate subdomains of changenow.io; find redirects to eth-btc.com
2. whois eth-btc.com confirms same owner; enumerate subdomains
3. Find zbx.sup.eth-btc.com Zabbix with guest sign-in; error logs leak eth-btc.net
4. Enumerate eth-btc.net; find argo-ws.stage.aws.eks.eu.1.eth-btc.net Argo dashboard with no auth
5. Create workflow from poc.yaml modified to reverse-shell to attacker server
6. Start netcat listener; submit workflow; receive root shell
7. Use backticks to execute commands and upgrade to TTY shell
**How found:** Recon via subdomain enumeration and port probing; noticed redirects to eth-btc.com, whois confirmed ownership, then pivoted through Zabbix guest access and leaked error logs to discover eth-btc.net and the Argo dashboard. Googled 'argo workflow hackerone' to find a public RCE/container-escape PoC.
**Exploitation:** Attacker submits a crafted Argo workflow via the unauthenticated dashboard; the workflow pod executes a reverse shell payload back to the attacker's listener, granting root inside the container and access to host files, AWS keys, and Docker.
**Escalation:** Guest Zabbix access leaked internal domain eth-btc.net, leading to the unauthenticated Argo dashboard and root shell; later confirmed staging config mirrored production.
**Insight:** Guest/low-priv monitoring dashboards (Zabbix guest sign-in) often leak internal hostnames in error logs; pivot those into enumerating sibling domains, and always check DevOps dashboards (Argo, Jenkins, Grafana) for missing auth since they often allow workflow/job creation leading to RCE.