HTB-Academy Command Injection Skills Assessment

1

I solved Command Injection Skill Assessment with payload:
?to=&from=2380029473.txt%26c\a\t%09${PATH:0:1}flag.txt&finish=1&move=1

6 Likes
2

Thank you! but what is your logic to get there? When I try to inject I do a search for something random and then I try to inject here
ajax=true&content=poc&path=.&type=search%26c\a\t%09${PATH:0:1}flag.txt

How did you come to that conclusion of injecting into the URL and not into the burpsuite field and where did you find &from= because I only see /index.php?to=

3

I’d like to add a “+” to the questions here :slight_smile: – I’m as well struggling to find the correct position to inject… I found the ‘from’ parameter, by clicking around in the app… But I could not inject something really helping until now… ZAP tells me a few ‘refrected’ injections (as “i:d” resulting in “Error while moving: mv: cannot stat ‘/var/www/html/files/i:d’: No such file or directory”)… not sure if that is of any help, since your question is a bit old now :slight_smile: