[black_panther]

Let's start Blurry

https://app.hackthebox.com/machines/605

[Szakyro]

I think we can use the steps from this article -> https://hiddenlayer.com/research/not-so-...ply-chain/

[black_panther]

/api/v2.27/

and

JWT

[Szakyro]

/api/v2.27/

and

JWT

You mean we need to attack via API?

[black_panther]

/api/v2.27/

and

JWT

You mean we need to attack via API?

Yes it could be

[mxntysec]

You can execute tasks with an ClearML agent, the problem is the web app doesn't have its own agent and using your own agent will only get you code exec as yourself...

──(root?kali)-[~/…/Medium/Blurry/enumeration/web]
└─# python -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.10.14.45 - - [08/Jun/2024 13:05:49] "GET /shell.sh HTTP/1.1" 200

[Szakyro]

You can execute tasks with an ClearML agent, the problem is the web app doesn't have its own agent and using your own agent will only get you code exec as yourself...

──(root?kali)-[~/…/Medium/Blurry/enumeration/web]
└─# python -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.10.14.45 - - [08/Jun/2024 13:05:49] "GET /shell.sh HTTP/1.1" 200

I think we somehow need to use that Chad Jippity user

[mxntysec]

You can execute tasks with an ClearML agent, the problem is the web app doesn't have its own agent and using your own agent will only get you code exec as yourself...

──(root?kali)-[~/…/Medium/Blurry/enumeration/web]
└─# python -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.10.14.45 - - [08/Jun/2024 13:05:49] "GET /shell.sh HTTP/1.1" 200

I think we somehow need to use that Chad Jippity user

One of the vulnerabilities recently was CSRF so maybe we can reset his password or something for access to some admin dashboard possibly

[Szakyro]

You can execute tasks with an ClearML agent, the problem is the web app doesn't have its own agent and using your own agent will only get you code exec as yourself...

──(root?kali)-[~/…/Medium/Blurry/enumeration/web]
└─# python -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.10.14.45 - - [08/Jun/2024 13:05:49] "GET /shell.sh HTTP/1.1" 200

I think we somehow need to use that Chad Jippity user

One of the vulnerabilities recently was CSRF so maybe we can reset his password or something for access to some admin dashboard possibly

I can't find any POCs on it's recent vulnerabilities..

[mxntysec]

You can execute tasks with an ClearML agent, the problem is the web app doesn't have its own agent and using your own agent will only get you code exec as yourself...

──(root?kali)-[~/…/Medium/Blurry/enumeration/web]
└─# python -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.10.14.45 - - [08/Jun/2024 13:05:49] "GET /shell.sh HTTP/1.1" 200

I think we somehow need to use that Chad Jippity user

One of the vulnerabilities recently was CSRF so maybe we can reset his password or something for access to some admin dashboard possibly

I can't find any POCs on it's recent vulnerabilities..

I'll look at the creator of the boxes GitHub, he could have a PoC maybe