Let's Begin

I'm seeing an SQL injection (boolean-based blind) in the login form:

sqlmap -u "http://faculty.htb/admin/ajax.php?action=login_faculty" --data "id_no=1111" -p id_no --batch --level 2 --dbms=Mysql

You can access admin dashboard with admin' -- - as the username

---

No idea how to proceed though, didn't find anything to do from there

(July 2, 2022, 07:17 PM)Erik Wrote: You can access admin dashboard with admin' -- - as the username

---

No idea how to proceed though, didn't find anything to do from there

Where did you find the admin dashboard?

Dirbusting, in /admin

School system seems to have severals exploits but no RCE

https://www.exploit-db.com/search?q=School+Faculty+Scheduling+System

Checking if I find an RCE

(July 2, 2022, 07:24 PM)Erik Wrote: Dirbusting, in /admin

There is an admin user in the database dump, but I couldn't crack the hash.

There are also 3 valid IDs for http://faculty.htb/login.php

Found those two things but not sure if that's any useful yet :
https://github.com/mpdf/mpdf/issues/949
https://pentest.co.uk/labs/leveraging-xss-to-get-rce-in-textpattern/

---

How can this be harder than Carpe Diem, fuck me

When I'm adding (and encoding) to the pdf parameter of /admin/download.php, I'm getting an incoming request to my Python server.

[quote="Exa" pid="117869" dateline="1656792178"]When I'm adding (and encoding) to the pdf parameter of /admin/download.php, I'm getting an incoming request to my Python server.[/quote]From you or from the taget ?