[hooneyman]

I'm Starting with Cybermonday #hard machine...   we can to put our hints here for help.


22/tcp open  ssh    syn-ack ttl 63
80/tcp open  http    syn-ack ttl 62


in cybermonday.htb/.htacess 

<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>


But i think right path is injecting SQL or working with LARAVEL.. i got some errors with laravel console.

[HerVelizy]

May be shall we forge the JWT Token.

But it seems to be corrupted (incorrect signature)

[redtaperecorder]

laravel error page - thought command injection, no dice?

[Mandelio]

May be shall we forge the JWT Token.

It's not a JWT token, it's just a JSON encoded in B64. Notice that there aren't any dots in the cookie ^^"

I think we should keep on trying to exfiltrate via the 500 error stacktrace thing...

[BigBaller]

Updating a profiles email with an empty box takes you to the illuminate stackstrace and leaks the SQL queries. They're using prepared statements, so it doesn't look like they're vulnerable. Username field doesn't seem to be exploitable with SSTI. Figured out that login request can be JSON too, so I tried to bypass with null values in json and also no luck. Potentially we are missing something within enumeration? Is there a way to get entire files from illuminate?

[BigBaller]

Connecting to http://cybermonday.htb/assets../.env gives you the .env file. This gives you the APP_KEY variable, so now it's possible to forge the Laravel token and possibly get access as admin to reach dashboard. After looking around in the code, there should be a file upload in the dashboard to create a new product.

APP_NAME=CyberMonday
APP_ENV=local
APP_KEY=base64:EX3zUxJkzEAY2xM4pbOfYMJus+bjx6V25Wnas+rFMzA=
APP_DEBUG=true
APP_URL=http://cybermonday.htb

LOG_CHANNEL=stack
LOG_DEPRECATIONS_CHANNEL=null
LOG_LEVEL=debug

DB_CONNECTION=mysql
DB_HOST=db
DB_PORT=3306
DB_DATABASE=cybermonday
DB_USERNAME=root
DB_PASSWORD=root

[BigBaller]

I'm in the webhooks but it seem you need to put the admin role
in the jwt

https://imgur.com/a/NMK4DnF

I've been trying to figure out the format of the laravel cookies. The first portion appears to be static, but the second portion is semi dynamic. Is it encrypted again somehow??

[4ip0k]

I'm in the webhooks but it seem you need to put the admin role
in the jwt

https://imgur.com/a/NMK4DnF

I've been trying to figure out the format of the laravel cookies. The first portion appears to be static, but the second portion is semi dynamic. Is it encrypted again somehow??

second portion - it's _token ( request during registration exp: _token=QorEraYXs3BJy53YN8vua2kQNdt3VvMr1K9dawnK&username=test&email=test%40test.test&password=test )

[redtaperecorder]

There is a .git folder in /assets../.git. Upon examining the content, we can perform a mass assignment.

@if(auth()->user()->isAdmin)

+                            <a href="{{ route('dashboard') }}"

 
to access the dashboard panel.

How did you find /assets.. ??

[HerVelizy]

I'm in the webhooks but it seem you need to put the admin role
in the jwt

https://imgur.com/a/NMK4DnF

I've been trying to figure out the format of the laravel cookies. The first portion appears to be static, but the second portion is semi dynamic. Is it encrypted again somehow??

I have the same issue.

Did someone try CVE-2018-15133 ?