[JacoPwn]

Currently stuck on the last send of the payload, how do you guys managed to combine both the GIF prefix filters and those required by the payload to work (i.e., zlib inflate)?

[gwen12345]

FInally i got shell

└─$ nc -lnvp 4444
listening on [any] 4444 ...
connect to [10.10.x.x] from (UNKNOWN) [10.129.204.166] 56708
bash: cannot set terminal process group (1): Inappropriate ioctl for device
bash: no job control in this shell
www-data@bf9a078a3627:/var/www/html/wordpress/wp-admin$

can you share your scripts in order to get a reverse shell back? Thank you

[ffck]

I have been at it for hours at this point. I still can't understand why the fuck I am missing some file bytes at the end of LFI exploit.
Any thoughts?

---

can someone provide links to CVEs about this machine foothold?

There are two CVEs to be chained for foothold with this machine, the first one is CVE-2023–26326 (Writeup: https://medium.com/tenable-techblog/word...ecb5575ed8)
The second one is CVE-2024-2961, it even uses the previous one as a demonstration for the deserialization (Writeup: https://www.ambionics.io/blog/iconv-cve-2024-2961-p1, PoC: https://github.com/ambionics/cnext-exploits)

The exploit needs to be tweaked accordingly to work properly.

what we need to change, is the cnext-exploit.py is enough or we need to do some steps before running it?

[Cipiki]

At the last step impossible to get a root rev shell or bash SUID

r = requests.post("http://127.0.0.1:9090/command", headers={
    "Authorization": "Bearer " + token
}, json={
    "command": "send_image",
    "output_file": "/tmp/exploit"
})

exploit like this :

#!/bin/sh
chmod +s /bin/bash

[breached_idn]

i just gained a foothold after suffering, how do i escape docker or laterally move to another host

---

i just gained a foothold after suffering, how do i escape docker or laterally move to another host

ah nvm, for tho who still struggle with how to get the user flag after getting a foothold, just read wp-config.php. there is credential for logging into the db and the host ip. so you need to port forward to that host, access the db, and crack the user hash in it, after that using the credential to logging into SSH.

finally got a revshell for initial foothold, where should i go after this? 
i am not sure about this wp-config.php since we can already read it using LFI, can you please elaborate more?

[hijoxi6719]

I have been at it for hours at this point. I still can't understand why the fuck I am missing some file bytes at the end of LFI exploit.
Any thoughts?

---

can someone provide links to CVEs about this machine foothold?

There are two CVEs to be chained for foothold with this machine, the first one is CVE-2023–26326 (Writeup: https://medium.com/tenable-techblog/word...ecb5575ed8)
The second one is CVE-2024-2961, it even uses the previous one as a demonstration for the deserialization (Writeup: https://www.ambionics.io/blog/iconv-cve-2024-2961-p1, PoC: https://github.com/ambionics/cnext-exploits)

The exploit needs to be tweaked accordingly to work properly.

what we need to change, is the cnext-exploit.py is enough or we need to do some steps before running it?

The cnext-exploit.py is a base for the foothold. You need to modify its code, so you can leverage CVE-2023–26326 while sending payloads and receiving data from the server. 
Then you have to tweak your way around the exploit to bypass some mitigations introduced by the box's author and PHP filters just being a bitch.

[breached_idn]

i just gained a foothold after suffering, how do i escape docker or laterally move to another host

---

i just gained a foothold after suffering, how do i escape docker or laterally move to another host

ah nvm, for tho who still struggle with how to get the user flag after getting a foothold, just read wp-config.php. there is credential for logging into the db and the host ip. so you need to port forward to that host, access the db, and crack the user hash in it, after that using the credential to logging into SSH.

finally got a revshell for initial foothold, where should i go after this? 
i am not sure about this wp-config.php since we can already read it using LFI, can you please elaborate more?

nvm, got two users from wordpress's db, but it takes forever to crack the password.. stuck again, any hints?

[breached_idn]

You need a token first then you can inject any command. Did you get the token ?

yes i have the access_token. 

But when i try to inject command i fail : 
command: send_image , output_file :"etc/passwd" for example will give "error generating image: "
command : "ls" -> error: "invalid command'
output_file"test.png;id" => "error":"Output file path contains dangerous characters"

How did you get it ?

these a /login endpoint

Thanks. So here make sure you are sending `application/json' content-type and run something like `chmod u+s /bin/bash` as output_file. Then rest you know what to do
GG

how did you get the credentials for grafana?
i can't use the default auth user:password

[Void_Walker]

from kali local will give both flags automatically for those who want it. You can also read the python to see how to do the privesc portion if need be.

ensure you have paramiko 'pip install paramiko' and then ensure that blog.bigbang.htb is in your /etc/hosts file

then just run with python3 <script>.py

Thanks i will try that in a moment

[k0iwdxlaxtjxpomup]

For those still stuck on the foothold
go check for iconv ambionics blogpost.
Don’t over complicate yourself. You need to retrieve 3 informations, /proc/self/maps (you should not have too much pain for this one) and the libc.so.6. But the headers of this one is broken so use the script mentionned before to fix the libc and the exploit will work perfectly fine

Which exploit? cnext exploit?
How?