Posts tagged with

upload-vuln

HackTheBox - Bank Writeup

Bank is an easy Hack The Box Linux machine featuring a custom PHP banking app. An exposed /balance-transfer endpoint leaks valid credentials via an improperly encrypted .acc file. Authenticated access reveals a file upload bypass using a .htb extension, leading to RCE as www-data. Privilege escalation is achieved by exploiting a custom SUID binary (/var/htb/bin/emergency) to gain root access.

S SH∆FIQ∆IM∆N
October 15, 2022
1 min read

upload-vuln gobuster php-reverse-shell SUID
HackTheBox - Arctic Writeup

Arctic is an easy Hack The Box Windows machine featuring a vulnerable Adobe ColdFusion server. Initial access is gained via an unauthenticated file upload exploit. After obtaining a reverse shell, privilege escalation is achieved using the MS10-059 vulnerability, resulting in full system compromise.

S SH∆FIQ∆IM∆N
October 8, 2022
1 min read

CVE-2009-2265 juicy-potato seImpersonatePrivilege coldfusion rce smbserver.py upload-vuln lfi jsp-reverse-shell msfvenom
HackTheBox - Nibbles Writeup

Nibbles is an easy Hack The Box Linux machine featuring a custom blogging platform. A login blacklist adds a slight challenge, but username enumeration and basic password guessing lead to access. Once logged in, a vulnerable file upload function enables Remote Code Execution, resulting in a shell. Privilege escalation is achieved via a poorly secured root script.

S SH∆FIQ∆IM∆N
October 3, 2022
1 min read

CVE-2015-6967 nibbleblog php-reverse-shell gobuster upload-vuln
HackTheBox - Love Writeup

Love is an easy Windows machine featuring a vulnerable voting system web application. Initial enumeration reveals a service on port 5000, but direct access is denied. A secondary file scanner service is found to be vulnerable to SSRF, which is exploited to access an internal password manager. Credentials obtained from this allow authentication to the voting system, which is vulnerable to authenticated Remote Code Execution. This grants access as the phoebe user. Post-exploitation reveals AppLocker is enabled, but a misconfiguration allows privilege escalation by deploying a malicious .msi file, resulting in a shell as SYSTEM.

S SH∆FIQ∆IM∆N
August 25, 2021
1 min read

ssrf upload-vuln AlwaysInstallElevated winpeas msfvenom gobuster msi-file
HackTheBox - Base Writeup

Starting Point Machine

S SH∆FIQ∆IM∆N
August 13, 2021
1 min read

strcmp-bypass upload-vuln GTFOBins gobuster SUID
HackTheBox - Oopsie Writeup

Starting Point Machine

S SH∆FIQ∆IM∆N
July 20, 2021
1 min read

SUID path-abused upload-vuln gobuster python php-reverse-shell