[RedBlock]

Creator Boxes:



Sea

Chemistry

Alert

Cat

Dog

Code


Overall, the boxes were interesting and offered something new in each one.

---

http://nocturnal.htb/view.php?username=admin&file=FUZZ?

[kkkgrukckhko]

We can use this syntax to check our uploads:

nocturnal.htb/view.php?username=amanda&file=privacy.odt

but i doesnt make my revshell work idk why, any suggest?

[thedubb1313]

It doesn't work because of "Content-Disposition: attachment;"
We can see the admin's session by changing the username, but it has no files. If you try another user it says the username is not found, but with admin it works. Can be a clue

[maggi]

We can use this syntax to check our uploads:

nocturnal.htb/view.php?username=amanda&file=privacy.odt

but i doesnt make my revshell work idk why, any suggest?

log into site as Amanda

Download backup

Dump the DB

ssh as that user

check local ports for interesting things

[samuelballsiu1]

Anyone knows what to do, to get root, after logged in through ssh as tobias?

[maggi]

Anyone knows what to do, to get root, after logged in through ssh as tobias?

Check ports there might be a CVE....

https://github.com/bipbopbup/CVE-2023-46...on-exploit

[samuelballsiu1]

Anyone knows what to do, to get root, after logged in through ssh as tobias?

Check ports there might be a CVE....

https://github.com/bipbopbup/CVE-2023-46...on-exploit

Oh yeah, we need valid credentials for that

[hujson]

We can use this syntax to check our uploads:

nocturnal.htb/view.php?username=amanda&file=privacy.odt

but i doesnt make my revshell work idk why, any suggest?

log into site as Amanda

Download backup

Dump the DB

ssh as that user

check local ports for interesting things

how to download the sql dump I'm geting a 403.

[samuelballsiu1]

We can use this syntax to check our uploads:

nocturnal.htb/view.php?username=amanda&file=privacy.odt

but i doesnt make my revshell work idk why, any suggest?

log into site as Amanda

Download backup

Dump the DB

ssh as that user

check local ports for interesting things

how to download the sql dump I'm geting a 403.

Login as amanda:arHkG7HAI68X8s1J

Create backup with the password arHkG7HAI68X8s1J

and unzip with the same password arHkG7HAI68X8s1J

[hujson]

We can use this syntax to check our uploads:

nocturnal.htb/view.php?username=amanda&file=privacy.odt

but i doesnt make my revshell work idk why, any suggest?

log into site as Amanda

Download backup

Dump the DB

ssh as that user

check local ports for interesting things

how to download the sql dump I'm geting a 403.

Login as amanda:arHkG7HAI68X8s1J

Create backup with the password arHkG7HAI68X8s1J

and unzip with the same password arHkG7HAI68X8s1J

Thanks it worked. But how did you find the creds for that account?