[raidenei]

## User.txt

ssh graphasm@cypher.htb

Pass: cU4btyib.20xtCMCXkBmerhK

## Root.txt

sudo /usr/local/bin/bbot -cy /root/root.txt -d --dry-run

hi sir i get this respond:
GET /?username=graphasm&hash=9f54ca4c130be6d529a56dee59dc2b2090e43acf

How do you get the cleartext?

[OffensiveBias]

How did you manage to find the exact command needed to exploit login cypher injection ? Did you use cyphermap.py.? If so in my case it does not seems to be working can you share the command that you gave it to make it work?

[llamamorg]

How did you manage to find the exact command needed to exploit login cypher injection ? Did you use cyphermap.py.? If so in my case it does not seems to be working can you share the command that you gave it to make it work?

If you already found the jar file you may notice that its titled 'custom-apoc-extension...' I didn't realize it at first, but this is a good clue about how to leverage the injection. The post below is a good primer on cypher injection and using APOC modules. 
https://www.varonis.com/blog/neo4jection...d-exploits

[llamamorg]

Sorry, worth mentioning that none of the APOC payloads on the page i mentioned above will work on their own. Still good food for thought :v:

[slimeylimey]

You can also obtain a shell via the /api/cypher endpoint, optionally.

thanks matthew appreciate your skills

matthew is a cool name, i'll go by it from now on.

[vanatka123]

root:
sudo /usr/local/bin/bbot --custom-yara-rules /root/root.txt -d

[test888]

Is there a way to get a reverse as root?

[PaiN05]

Yo Red Block Did You recognize me?

[shu8uiuhosduhio]

the root privesc was so straightforward cool box

[lenteja45]

the privesc was too easy, not a medium machine the only hard was finding the weird payload for the cypher injection, theres no much information about it...