[llamamorg]

I think i'm at the same place Donde. Can hit the teamserver port on 40056 with SSRF, it even responds that websockets are available but when trying to send a manually request to upgrade it, it just fails every time. There is the tls note on 8000 that shows a git diff where they disabled TLS on the websocket interface on 40056 but... i'm still missing something.

[Donde]

I think i'm at the same place Donde. Can hit the teamserver port on 40056 with SSRF, it even responds that websockets are available but when trying to send a manually request to upgrade it, it just fails every time. There is the tls note on 8000 that shows a git diff where they disabled TLS on the websocket interface on 40056 but... i'm still missing something.

Pretty sure that note is just to tell us we are on the right way. If ssl was on you'd have to manage that in your code and that would be a horror.

[thedubb1313]

It's the "connection" header. If you change it from close to upgrade the server doesn't respond. Maybe there's a websocket header that we're missing

[ZenMunk3y]

I think i'm at the same place Donde. Can hit the teamserver port on 40056 with SSRF, it even responds that websockets are available but when trying to send a manually request to upgrade it, it just fails every time. There is the tls note on 8000 that shows a git diff where they disabled TLS on the websocket interface on 40056 but... i'm still missing something.

how are you getting it to respond that websockets are available?

I can only get it to tell me if a URI exists or not

[iiNovaCore]

I think i'm at the same place Donde. Can hit the teamserver port on 40056 with SSRF, it even responds that websockets are available but when trying to send a manually request to upgrade it, it just fails every time. There is the tls note on 8000 that shows a git diff where they disabled TLS on the websocket interface on 40056 but... i'm still missing something.

how are you getting it to respond that websockets are available?

I can only get it to tell me if a URI exists or not

did you read the prior code that said its a websocket? it earlier said that port 40056 is a websocket, on that file on port 8000.

[ZenMunk3y]

ok so just a thought, when you try to ssh to the box it doesn't ask you for a password and looks like it's set up to use id_rsa for authentication. So this makes me think we have to use the SSRF to be able to get that file somehow in order to get access as either ilya or sergej.

[samuelballsiu1]

Someone, pleaseee. Leak this fucking script

[alexbobarszismyname]

Someone, pleaseee. Leak this fucking script

write it yourself brotha

[0xdaniii]

Someone, pleaseee. Leak this fucking script

write it yourself brotha

brother can you share with me i am having some problems it is giving me shell of my machine instead of target

[OM17]

Someone, pleaseee. Leak this fucking script

write it yourself brotha

Is the idea of combing the rce with the ssrf so we can reach the internal port correct?

Don't want to be wasting my time