[U2t5d2lu]

i think You can recognize port on localhost via fetch endpoint (5005) but no idea so far what to do next

[hackwell]

there's aws

``` S3 operation failed; code: NoSuchKey, message: The specified key does not exist., resource: /guest//etc/passwd, request_id: 17B075BBE1C0F812, host_id: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, bucket_name: guest, object_name: etc/passwd ```

when accessing http://demo.skyfall.htb/download_file?fi...etc/passwd

[U2t5d2lu]

i think You can recognize port on localhost via fetch endpoint (5005) but no idea so far what to do next

Nice finding, but i logs me out, do you get any specific response?
i think it might a blind SSRF

just 502 bad gateway and service is restarting

[Vapulame]

there's aws

``` S3 operation failed; code: NoSuchKey, message: The specified key does not exist., resource: /guest//etc/passwd, request_id: 17B075BBE1C0F812, host_id: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, bucket_name: guest, object_name: etc/passwd ```

when accessing http://demo.skyfall.htb/download_file?fi...etc/passwd

should be minio to be specific, am thinking enum buckets with the ssrf maybe not sure

[gtastav]

there's aws

``` S3 operation failed; code: NoSuchKey, message: The specified key does not exist., resource: /guest//etc/passwd, request_id: 17B075BBE1C0F812, host_id: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, bucket_name: guest, object_name: etc/passwd ```

when accessing http://demo.skyfall.htb/download_file?fi...etc/passwd

I actually think its minio , it just has a S3 interface.

[hackwell]

mmm... skyfall ? cloud ?

[chillywilly]

no its james bond skyfall, vue to a kill https://portswigger.net/daily-swig/vue-t...s-revealed

[Art10n]

S3 operation failed; code: NoSuchKey, message: Object does not exist, resource: /guest/test.txt, request_id: 17B077A43BE44FF4, host_id: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, bucket_name: guest, object_name: test.txt

This implies AWS and S3 enum, I guess

[Blackoofconsequently]

no its james bond skyfall, vue to a kill https://portswigger.net/daily-swig/vue-t...s-revealed

But vue isnt used anywhere on the server afaik

[xxxbfacc]

filename=yyy returns error:

S3 operation failed; code: NoSuchKey, message: The specified key does not exist., resource: /guest/yyy, request_id: 17B0790FC421D09E, host_id: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, bucket_name: guest, object_name: yyy

filename=../xxx/yyy returns error:

S3 operation failed; code: SignatureDoesNotMatch, message: The request signature we calculated does not match the signature you provided. Check your key and signing method., resource: /xxx/yyy, request_id: 17B079010DB96CC8, host_id: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, bucket_name: xxx, object_name: yyy

So we are traversing buckets with the ../ but strangely

filename=../guest/Welcome.pdf (or any file we uploaded) also returns an error:

S3 operation failed; code: SignatureDoesNotMatch, message: The request signature we calculated does not match the signature you provided. Check your key and signing method., resource: /guest/Welcome.pdf, request_id: 17B07923A86DCA80, host_id: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, bucket_name: guest, object_name: Welcome.pdf