[someonesomewhere]

Unescaped variable use in conditionals can be influenced to always validate true.

Can you explain more ? Unquoted bash injection is that ? I never exploited this and im trying a few things but I can't find a good payload, do u have any good docs for ?

[nenandjabhata]

I need some help for root

[Jac0810]

what should I do with the mysql root password?

[nenandjabhata]

what should I do with the mysql root password?

Where did you find the mysql password ?

[Jac0810]

what should I do with the mysql root password?

f**k... it was the most simple thing... don't overthink it

[nenandjabhata]

what should I do with the mysql root password?

f**k... it was the most simple thing... don't overthink it

I haven't got anything bro. can you give me the way

[Jac0810]

nice link ...

user hints : 
there are two ways :all the  PoCs  here valid and working , or u can use require('node:child_process')  and write your own ... each them end up whit RCE 

Root : 
2 ways : exfill char by char , manually or via script  OR u can use  2 ssh session and pspy but may is the unintended way,faster for sure 

p.s. if u want learn do a jucy script to exfill chars

use the 2 ssh session... 1 with pspy and 1 the mysql-backup. you'll get root pass

[someonesomewhere]

nice link ...

user hints : 
there are two ways :all the  PoCs  here valid and working , or u can use require('node:child_process')  and write your own ... each them end up whit RCE 

Root : 
2 ways : exfill char by char , manually or via script  OR u can use  2 ssh session and pspy but may is the unintended way,faster for sure 

p.s. if u want learn do a jucy script to exfill chars

use the 2 ssh session... 1 with pspy and 1 the mysql-backup. you'll get root pass

Taht's what im doing but nothing

[nenandjabhata]

nice link ...

user hints : 
there are two ways :all the  PoCs  here valid and working , or u can use require('node:child_process')  and write your own ... each them end up whit RCE 

Root : 
2 ways : exfill char by char , manually or via script  OR u can use  2 ssh session and pspy but may is the unintended way,faster for sure 

p.s. if u want learn do a jucy script to exfill chars

use the 2 ssh session... 1 with pspy and 1 the mysql-backup. you'll get root pass

I tried it for many hours.

2023/11/05 01:24:13 CMD: UID=0    PID=1      | /sbin/init
2023/11/05 01:24:22 CMD: UID=1001  PID=286544 | node /var/www/editor/index.js                                       
2023/11/05 01:24:22 CMD: UID=1001  PID=286545 | /bin/sh -c ping -2 10.10.10.10
2023/11/05 01:25:05 CMD: UID=1000  PID=286546 | -bash
2023/11/05 01:25:05 CMD: UID=0    PID=286548 | sudo ./mysql-backup.sh
2023/11/05 01:25:05 CMD: UID=0    PID=286547 | sudo ./mysql-backup.sh
2023/11/05 01:25:05 CMD: UID=0    PID=286549 |
2023/11/05 01:25:49 CMD: UID=0    PID=286550 | /bin/bash /opt/scripts/mysql-backup.sh 

I am not getting interessting things.

[Jac0810]

use pspy -f to see th details of execution