[paven]

Skyfall - Linux - Insane

Good luck everyone! Let's tackle this together!
https://app.hackthebox.com/machines/Skyfall

[paven]

Guy's last T-2 hrs before the challenge begins

[DataNinja]

demo.skyfall.htb

posible unrestricted file upload

http://demo.skyfall.htb/files

[Steward]

How did you login? SQLi does not work, rockyou is exhausted for all three users

[DeepDrop]

How did you login? SQLi does not work, rockyou is exhausted for all three users

use guest:guest

[U2t5d2lu]

maybe endpoint with potential ssrf on fetch

[peRd1]

maybe endpoint with potential ssrf on fetch

yes, uploader+downloader works. and GET /fetch hits back home...

[DataNinja]

uploaded a shell.php but cant trigger it and downloading does nothing

Think logically: the website uses Flask (Python), not PHP.

[Art10n]

Cookie decoded: flask-insign

{'_fresh': True, '_id': '1c26577c0e4ec6afcf478aca7923069824db76ff0e5075f97569c948773ba0e7b58b90481e6f15d06d527ad8aa52e375cc27f0fbf6582e8045d8d75353327a12', '_user_id': '1', 'csrf_token': 'aa237d20d7e1ebe1c8f2722ccf76d77b24fbbe00'}

[peRd1]

Cookie decoded: flask-insign

{'_fresh': True, '_id': '1c26577c0e4ec6afcf478aca7923069824db76ff0e5075f97569c948773ba0e7b58b90481e6f15d06d527ad8aa52e375cc27f0fbf6582e8045d8d75353327a12', '_user_id': '1', 'csrf_token': 'aa237d20d7e1ebe1c8f2722ccf76d77b24fbbe00'}

flask unsign, but sadly we need the secret to sign admin cookies hahaha