[haykino]

please i need help, im stucked in the apethanto uni ctf, i managed to find the metabase but the rce is not working.

[Vakeraz]

I'm also stuck on priv'esc for Apethanto . I've got easy web & forensic if you wanna trade

[caccapuzza]

hey I change Apethanto root steps for the web and pwn easy challenges

dm me i got what u need

[zapot]

hi all , i got rev-shell
i need a hint for Apethanto root

[zapot]

using the cve i got rev-shell
https://github.com/shamo0/CVE-2023-38646...3-38646.py
but u need to add token and collaborator url

[PingPong123a]

Need a hint on the last reverse chall plz

[AliceSynthesis]

Anyone else working on Nexus_Void?
Able to login as the "clown" with a simple SQLi on password,
but can't seem to figure the next step.
I assume it has something to do with the Wishlist, as it returns a 500 for everything else than a request with valid params.
Will try to sqlmap that, but would appreciate a hint :3

[st123]

Anyone else working on Nexus_Void?
Able to login as the "clown" with a simple SQLi on password,
but can't seem to figure the next step.
I assume it has something to do with the Wishlist, as it returns a 500 for everything else than a request with valid params.
Will try to sqlmap that, but would appreciate a hint :3

Oh i thought that one is something to do with how its deserializing data. maybe get rce through that. coz theres no other way to get the flag lol

[AliceSynthesis]

Anyone else working on Nexus_Void?
Able to login as the "clown" with a simple SQLi on password,
but can't seem to figure the next step.
I assume it has something to do with the Wishlist, as it returns a 500 for everything else than a request with valid params.
Will try to sqlmap that, but would appreciate a hint :3

Oh i thought that one is something to do with how its deserializing data. maybe get rce through that. coz theres no other way to get the flag lol

Have Web challenges required shell access in the previous CTFs?
I can't recall but it seems rather weird imo.

[st123]

Anyone else working on Nexus_Void?
Able to login as the "clown" with a simple SQLi on password,
but can't seem to figure the next step.
I assume it has something to do with the Wishlist, as it returns a 500 for everything else than a request with valid params.
Will try to sqlmap that, but would appreciate a hint :3

Oh i thought that one is something to do with how its deserializing data. maybe get rce through that. coz theres no other way to get the flag lol

Have Web challenges required shell access in the previous CTFs?
I can't recall but it seems rather weird imo.

yea there have been challenges like that in the past. Mostly using the python pickle exploits . Maybe this time they wanted to do the same but with c#