[pop10189]

Let's discusses HTB Desires  web challenge

[pop10189]

Since there is no hints, here you go;

 https://github.com/mholt/archiver/pull/396
CVE-2024-0406

 You would be able to exploit the archive library (To create files outside the saved directory) but you can't  overwrite files (as i know now).

[ZombieBear]

You can add CVE-2024-38513 https://github.com/advisories/GHSA-98j2-3j3p-fw2v to the observation...

>You would be able to exploit the archive library (To create files outside the saved directory) but you can't overwrite files (as i know now).
Correct for tar archives

[sdksdk]

It is not mine but almost the same i did. Try to understand how the .TAR file is crafted.

https://github.com/walidpyh/CVE-2024-040.../script.py

[hackerone12]

Let's discusses HTB Desires  web challenge

It's incredible how you have all this stuff, I love it

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[BFischer]

It is not mine but almost the same i did. Try to understand how the .TAR file is crafted.

https://github.com/walidpyh/CVE-2024-040.../script.py

How did you know that's a CVE-2024-0406

[Cth1hu_R1y3h]

It is not mine but almost the same i did. Try to understand how the .TAR file is crafted.

https://github.com/walidpyh/CVE-2024-040.../script.py

How did you know that's a CVE-2024-0406

Read the source code first, especially notice the special "imports", sometimes u can find CVEs in those third party imports

[pop10189]

It is not mine but almost the same i did. Try to understand how the .TAR file is crafted.

https://github.com/walidpyh/CVE-2024-040.../script.py

How did you know that's a CVE-2024-0406

Look into go.mod, you will find the version of archiver

[pop10189]

You can add CVE-2024-38513 https://github.com/advisories/GHSA-98j2-3j3p-fw2v to the observation...

>You would be able to exploit the archive library (To create files outside the saved directory) but you can't  overwrite files (as i know now).
Correct for tar archives

That's wired, been trying this without success

Edit: i dont think session fixation would work, since the token used by your user is created each time you login and updated on redis

[TechArtificer]

You can add CVE-2024-38513 https://github.com/advisories/GHSA-98j2-3j3p-fw2v to the observation...

>You would be able to exploit the archive library (To create files outside the saved directory) but you can't  overwrite files (as i know now).
Correct for tar archives

That's wired, been trying this without success

Edit: i dont think session fixation would work, since the token used by your user is created each time you login and updated on redis

Look closely at the code, you're on the right track.
You can forge the session, because you know how the session ID is generated and you can also update the session ID on redis without actually generating a session file.