[osamy7593]

Guys anyone read cronjobs ? To know where to add that dll

[olkn00b]

Have you guys managed to build a dll with rev shell?

Used multiple tools to dissassemble and try to build but nothing worked.

What tools have you used?

---

Has anyone tried to upload a pdf using msf and exploit/windows/fileformat/adobe_pdf_embedded_exe?

If tomas has login to the port on 3000, then it is likely that HTB has an automated "click" action for uploaded resumes?

It is not windows thoug

just an example - you can also update the payload to use a linux version as well for that one.

How can you set payload for linux in adobe_pdf_embedded_exe ? tried to 'set payload' for meterpreter and tcp but says incompatible. Also used the non js option same result.

[l3rka]

Guys anyone read cronjobs ? To know where to add that dll

u already can upload dll?
seems we need upload to /opt/components
and execute from lantern.htb:3000

[ir0nman4l1f3]

Have you guys managed to build a dll with rev shell?

Used multiple tools to dissassemble and try to build but nothing worked.

What tools have you used?

---

Has anyone tried to upload a pdf using msf and exploit/windows/fileformat/adobe_pdf_embedded_exe?

If tomas has login to the port on 3000, then it is likely that HTB has an automated "click" action for uploaded resumes?

It is not windows thoug

just an example - you can also update the payload to use a linux version as well for that one.

How can you set payload for linux in adobe_pdf_embedded_exe ? tried to 'set payload' for meterpreter and tcp but says incompatible. Also used the non js option same result.

Yea I looked into this further afterwards and linux isn't suppored... based on the rapid7 post, it made it seem like other platforms were supported...

[no-id]

GET /PrivacyAndPolicy?lang=../../../../../../&ext=./var/mail/tomas HTTP/1.1
Host: lantern.htb
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://lantern.htb/
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Sec-GPC: 1

From hr@lantern.htb Mon Jan 1 12:00:00 2023
Subject: Welcome to Lantern!

Hi Tomas,

Congratulations on joining the Lantern team as a Linux Engineer! We're thrilled to have you on board.

While we're setting up your new account, feel free to use the access and toolset of our previous team member. Soon, you'll have all the access you need.

Our admin is currently automating processes on the server. Before global testing, could you check out his work in /root/automation.sh? Your insights will be valuable.

Exciting times ahead!

Best.

[hackemall]

were are we puttting this dill file

[olkn00b]

were are we puttting this dill file

I believe we are uploading it inside the admin panel but how can we get it to execute at /var/www/sites/lantern.htb/static/images ? Must be an LFI mentioned earlier but I haven't found it.

[hackemall]

i have done that but is stuck there

[sk_Dutta]

i have done that but is stuck there

Did you got the shell ?

[jsvensson]

i tried to load test.dll generated from msfvenom to /opt/components it worked but as i try to run it i get Bad IL Format