Did anyone get foothold on machine through panel?

yep then you can use the xss on graph.htb?redirect= to exfil tokens of admin through the messages panel and then exploit ffmpeg localfile read to get user ssh

(May 4, 2022, 07:22 PM)Internetdreams Wrote: yep then you can use the xss on graph.htb?redirect= to exfil tokens of admin through the messages panel and then exploit ffmpeg localfile read to get user ssh

Can't find the URI for messages panel. Where is it?

(May 4, 2022, 07:22 PM)Internetdreams Wrote: yep then you can use the xss on graph.htb?redirect= to exfil tokens of admin through the messages panel and then exploit ffmpeg localfile read to get user ssh

Can you please tell a few more details?

I can make the server send requests to me. When I point to graph.htb?redirect=http://myip the referer is graph.htb but how to exploit that to get the cookie/token?

same here, interested to know a bit more about WHERE the XSS input can be abused? not inbox as that appears a static page, so where in messages. Did I miss an endpoint/page somewhere?

Thinking at the past i was able to use the redirect with an xss with a json payload... din't find the endpoint too :(

(May 4, 2022, 07:22 PM)Internetdreams Wrote: yep then you can use the xss on graph.htb?redirect= to exfil tokens of admin through the messages panel and then exploit ffmpeg localfile read to get user ssh

Got the XXS vector but how to submit this reflected XSS to the admin. How you mangaed to login to the website with normal user ? Is any bruteforce required ?

(May 3, 2022, 01:14 AM)Internetdreams Wrote:

(May 2, 2022, 06:26 PM)Exa Wrote: [quote="dude4695 hey bro i found a GRAPHQL when you can sendmessage but the detail, is that i don't know the gmails to send maybe i can send a XSS payload" pid="46719" dateline="1651471026"]
http://internal.graph.htb/

add this key and value in cookie's Local Storage

username          mark

username is key and mark is value
and go to
http://internal.graph.htb/profile
you will get panel access

I tried (Cookie: username=mark) but I get redirected back to the login page.

It's localstorage not cookies
[/quote]

---

anyone can help me plz

Has anyone managed to get anything from graph.htb/?redirect ? I mean, you can't read the localStorage/cookies info of internal.graph.htb from graph.htb...

(May 4, 2022, 01:51 PM)Exa Wrote:

(May 3, 2022, 01:14 AM)Internetdreams Wrote:

(May 2, 2022, 06:26 PM)Exa Wrote:

(May 2, 2022, 05:57 AM)dude4695 Wrote: http://internal.graph.htb/

add this key and value in cookie's Local Storage

username          mark

username is key and mark is value
and go to
http://internal.graph.htb/profile
you will get panel access

I tried (Cookie: username=mark) but I get redirected back to the login page.

It's localstorage not cookies

Thanks for the clarification. Local storage works.

But can't access to http://internal.graph.htb/inbox. We need a valid cookie.