Posts: 6
Threads: 0
Joined: Jan 2025
(Jan 18, 2025, 08:55 PM)StingEm Wrote: Has anyone had any luck combing the two exploits ? - Not sure if its just me going down rabbit hole? I'm noob so I don't know how you'd chain them.
I am able to get the SSRF to work against the box, and I can get the RCE to work locally, but no idea how to chain the two.
Posts: 17
Threads: 0
Joined: Apr 2024
I've not had any luck. I'm trying to understand what the first CVE is doing and how we can leverage that. If it is SSRF then we should be able to leverage it in some way! I'm just not that great with SSRF lol
Posts: 7
Threads: 0
Joined: Oct 2024
This was referenced earlier by someone: https://blog.chebuya.com/posts/server-si...-havoc-c2/
The author is same as box designer
Posts: 96
Threads: 2
Joined: Feb 2024
(Jan 18, 2025, 08:57 PM)LostGem Wrote: (Jan 18, 2025, 08:55 PM)StingEm Wrote: Has anyone had any luck combing the two exploits ? - Not sure if its just me going down rabbit hole?
I feel it was just a rabbit hole!!!
I agree, this is indeed a rabbit hole
Posts: 23
Threads: 0
Joined: Jan 2025
has anybody actually tried or are we just coping and saying its a rabbit hole? I'm trying to combine the 2 exploits but this is hard af
Posts: 9
Threads: 0
Joined: Jan 2025
I was trying send RCE exploits directly over SSRF. Then i tried to send it as a post body to the /havoc/ endpoint. It didn't work.
Posts: 196
Threads: 31
Joined: Apr 2024
Jan 18, 2025, 09:17 PM
(This post was last modified: Jan 18, 2025, 09:19 PM by maggi.)
https://github.com/IncludeSecurity/c2-vu...voc_rce.py
I have ben using this and keep getting
$ python script.py
{'Head': {'Event': 1, 'User': '', 'Time': '18/01/2025 16:17:00', 'OneTime': ''}, 'Body': {'SubEvent': 2, 'Info': {'Message': "User doesn't exits"}}}
$
with this at the top
HOSTNAME = "127.0.0.1"
PORT = 40056
USER = "sergej"
PASSWORD = "1w4nt2sw1tch2h4rdh4tc2"
Posts: 9
Threads: 0
Joined: Jan 2025
(Jan 18, 2025, 09:19 PM)bedtimexv Wrote: It works! The poc i referenced above and edit request data to ../../../etc/passwd and file is returned!
Are you sure that it is not your's /etc/passwd?
Posts: 36
Threads: 1
Joined: Jun 2023
(Jan 18, 2025, 09:19 PM)bedtimexv Wrote: It works! The poc i referenced above and edit request data to ../../../etc/passwd and file is returned!
can you elaborate ?
Posts: 23
Threads: 0
Joined: Jan 2025
(Jan 18, 2025, 09:17 PM)maggi Wrote: https://github.com/IncludeSecurity/c2-vu...voc_rce.py
I have ben using this and keep getting
$ python script.py
{'Head': {'Event': 1, 'User': '', 'Time': '18/01/2025 16:17:00', 'OneTime': ''}, 'Body': {'SubEvent': 2, 'Info': {'Message': "User doesn't exits"}}}
$
with this at the top
HOSTNAME = "127.0.0.1"
PORT = 40056
USER = "sergej"
PASSWORD = "1w4nt2sw1tch2h4rdh4tc2"
i think you're hitting yourself
|