[nenandjabhata]

lets try to see if we can get creds for leila and be able to push .php code
also I register on gitea but will not let me log in is this happening to others?
did anyone inspect 3000 is express

I could register and login.
Repos:
leila / ouija-htb
User:
leila
Organization:
-

Haven't pushed anything so far , trying some other stuff before.

hmm it did not let me login, I am able to do things with the api tho....
maybe I need to reset box... (again)
[edit] yes I restarted now I can log in from UI

---

ok so I am almost sure the way in is for sure related to port 3000
"ihash header is missing"
found 3 parameters so far.
/Users/
/Register/
/login/

maybe lets ty to pass the creds info from gitea to this api

did you found any valid creds on the gitea ?

[blade33]

lets try to see if we can get creds for leila and be able to push .php code
also I register on gitea but will not let me log in is this happening to others?
did anyone inspect 3000 is express

I could register and login.
Repos:
leila / ouija-htb
User:
leila
Organization:
-

Haven't pushed anything so far , trying some other stuff before.

hmm it did not let me login, I am able to do things with the api tho....
maybe I need to reset box... (again)
[edit] yes I restarted now I can log in from UI

---

ok so I am almost sure the way in is for sure related to port 3000
"ihash header is missing"
found 3 parameters so far.
/Users/
/Register/
/login/

maybe lets ty to pass the creds info from gitea to this api

when login it asks for a uname upass but post is disabled...

GET /login?uname=aaa&upass=password

but login is disabled anyway: {"message":"disabled (under dev)"}

[RebeLHeX]

header:

ihash: test
Identification: test


results on:
"Invalid Token"

on
/Users

[edit]
In gitea UI I created a new token and tried that with no luck, but maybe I did something wrong, someone else should check

[peRd1]

In gitea UI I created a new token and tried that with no luck, but maybe I did something wrong, someone else should check

Also tried that without any luck so far

Pretty sure that it's about the smuggling vulnerability and checking requests on the server status page 

https://www.mail-archive.com/haproxy@for...43229.html

[RebeLHeX]

In gitea UI I created a new token and tried that with no luck, but maybe I did something wrong, someone else should check

Also tried that without any luck so far

Pretty sure that it's about the smuggling vulnerability and checking requests on the server status page 

https://www.mail-archive.com/haproxy@for...43229.html

Interesting, reading about it and how it works now.

[chillywilly]

header:

ihash: test
Identification: test


results on:
"Invalid Token"

on
/Users

[edit]
In gitea UI I created a new token and tried that with no luck, but maybe I did something wrong, someone else should check

where did you create token from 
also these on the readme might be used
id: 1
owner: Ouija

[RebeLHeX]

In gitea UI I created a new token and tried that with no luck, but maybe I did something wrong, someone else should check

Also tried that without any luck so far

Pretty sure that it's about the smuggling vulnerability and checking requests on the server status page 

https://www.mail-archive.com/haproxy@for...43229.html

Did you find any POC?
I was able to read https://portswigger.net/web-security/req...-smuggling
and then I found something related that pin points better the vuln https://www.haproxy.com/blog/february-20...rser-fixed
with an entry:
```
This vulnerability affects the header parser and permits header manipulations that might be unauthorized or dangerous.
Examples:

• a transfer-encoding header may be hidden after the presence of a content-length header is confirmed and sent to another proxy
  
• a transfer-encoding header or a content-length header may be hidden after the internal parser has confirmed its presence; in this scenario, the parser will consider the missing header to still be present.
  

```

so I am trying myseld with all 3 paths we know looking at the apache status
I only see my request when doing GET and not posts.. trying:
on gitea.ouija.htb
POST an d GET to  /user/events HTTP/1.1
on
ouija.htb
POST and GET to /

no luck so far, or i am following the directions/examples from here wrong: https://portswigger.net/web-security/req...ng/finding

[caccapuzza]

From gitea you can see the version of haproxy being used: 2.2.16
but the integer overflow doesn't work for both port 80 and 3000.
All the payloads from PortSwigger academy doesn't work.
I'm pretty sure is Request Smuggling but still don't know how to leverage that
 2.2.2.16

[RebeLHeX]

is because is not the integer overflow is the transfer-encoding header with chunk I am trying something like t his:
header:
Transfer-Encoding: chunked
content-length: 115

body:
0


GET http://ouija.htb/admin/ HTTP/1.1
Host: ouija.htb
h: GET /contactform/contactform.js HTTP/1.1
HOST ouija.htb

---

Is the vuln from 2023 not the older one from 2019 (I think)
from the CVE
Examples:

a transfer-encoding header may be hidden after the presence of a content-length header is confirmed and sent to another proxy

---
so I am trying to hide one of those to force the other to be passed to HAproxy I may be wrong tho, just trying things

[nosoyyo]

I have lfi through Http Smugglin, currently trying to escalate privileges in the 3000 api