Photobomb - HTB [Discussion]
by - Thursday, January 1, 1970 at 12:00 AM
(October 8, 2022, 08:22 PM)Hacker2222 Wrote: injection in image converter ............. just add png;REVSHELL instead of png in request


bru i tried this earlier in the wrong parameter and forgot to url encode :skull:
Reply
yeah got the system access
Reply
(October 8, 2022, 08:22 PM)Hacker2222 Wrote: injection in image converter ............. just add png;REVSHELL instead of png in request


pls explain further
Reply
(October 8, 2022, 08:31 PM)araaraara Wrote:
(October 8, 2022, 08:22 PM)Hacker2222 Wrote: injection in image converter ............. just add png;REVSHELL instead of png in request


pls explain further


filetype:png;ping -c 20 127.0.0.1
it will delay for 20 sec
then try for python reverse shell access
Reply
(October 8, 2022, 08:36 PM)pandu Wrote:
(October 8, 2022, 08:31 PM)araaraara Wrote:
(October 8, 2022, 08:22 PM)Hacker2222 Wrote: injection in image converter ............. just add png;REVSHELL instead of png in request


pls explain further


filetype:png;ping -c 20 127.0.0.1
it will delay for 20 sec
then try for python reverse shell access

url encoded?
Reply
(October 8, 2022, 08:36 PM)pandu Wrote:
(October 8, 2022, 08:31 PM)araaraara Wrote:
(October 8, 2022, 08:22 PM)Hacker2222 Wrote: injection in image converter ............. just add png;REVSHELL instead of png in request


pls explain further


filetype:png;ping -c 20 127.0.0.1
it will delay for 20 sec
then try for python reverse shell access


the python #2 in revshells?
Reply
please give more hints
Reply
(October 8, 2022, 08:37 PM)araaraara Wrote:
(October 8, 2022, 08:36 PM)pandu Wrote:
(October 8, 2022, 08:31 PM)araaraara Wrote:
(October 8, 2022, 08:22 PM)Hacker2222 Wrote: injection in image converter ............. just add png;REVSHELL instead of png in request


pls explain further


filetype:png;ping -c 20 127.0.0.1
it will delay for 20 sec
then try for python reverse shell access

url encoded?


no just add + symbol for spacing
Reply
(October 8, 2022, 08:45 PM)pandu Wrote:
(October 8, 2022, 08:37 PM)araaraara Wrote:
(October 8, 2022, 08:36 PM)pandu Wrote:
(October 8, 2022, 08:31 PM)araaraara Wrote:
(October 8, 2022, 08:22 PM)Hacker2222 Wrote: injection in image converter ............. just add png;REVSHELL instead of png in request


pls explain further


filetype:png;ping -c 20 127.0.0.1
it will delay for 20 sec
then try for python reverse shell access

url encoded?


no just add + symbol for spacing


but what will pinging the localhost do any good?
Reply
(October 8, 2022, 08:41 PM)araaraara Wrote: please give more hints


Use Burpsuit to inject the payload. Get the rev shell payload here: https://www.revshells.com/. Python3 is fine then!
Try it by yourself. If u don't know then try another platform that is easier than hack the box!
Reply


 Users viewing this thread: Photobomb - HTB [Discussion]: No users currently viewing.