Module "WEB requests". To get the flag, use cURL to download the file returned by '/download.php' in the above server

You need elevated permissions. Use sudo when editing the file.
-onthesauce

I entered the cmd below, but I can’t download the file named download.php
curl -0 46.101.52.69:31273/download.php

That IP address and the port number is what the question ask to use. Can someone help me here.

you have to submit the key inside the file that you downloaded from server

so the syntax will be :

curl -O ipaddress:port/download.php

then

cat download.php

then you will get key inside the file , that key you have to submit as an answer.

The problem is, that cmd is not downloading the file. I have tried this on multiple days on different IPs. Could you try it.

[★]$ pwd
/home/htb-ac538885
─[us-academy-2]─[10.10.14.28]─[htb-ac538885@pwnbox-base]─[~]
└──╼ [★]$ ls
Desktop Documents Downloads Templates
─[us-academy-2]─[10.10.14.28]─[htb-ac538885@pwnbox-base]─[~]
└──╼ [★]$ curl -0 209.97.142.95:30707/download.php
HTB{64$!c_cURL_u$3r}─[us-academy-2]─[10.10.14.28]─[htb-ac538885@pwnbox-base]─[~]
└──╼ [★]$ ls
Desktop Documents Downloads Templates
─[us-academy-2]─[10.10.14.28]─[htb-ac538885@pwnbox-base]─[~]
└──╼ [★]$

inside the question you will see swap with target system option. first click on that then you will get
the ip with port then use that ip and port for download.

for instance : syntax will look like this
curl -O 10.30.29.39:8080/download.php // here -O means --remote-name Write output to a file named as the remote file

then cat download.php or you can also use text editor because the purpose is only to get the key from download.php

image
Worked for me here on the photo attached

1 Like

image
here is the sample solution curl IP:port/download.php inlanefreight.com

please i am having challenge on this, i can’t find the /downlaod.php

image
i can’t start my instance
pls i need assist and directions

Thank you.

curl -O 94.237.59.206:48181/download.php

after ls to see file and open it there is your flag!


How long should it take to download the .php file? I have run this command and it never seems to return anything. Am I missing something?

For those who have problems with this task, here is the solution.
First of all, don’t search for the ip address “inlanefreight.com” with the command “nslookup” because you have to first below the HTB screen there is a “target” button once you turn it on it will show you the ip address with the destination port.
Once you have the address and port you need to type the following command.

sudo curl -O {ADDRESS IP}:{PORT}/download.php inlanefreight.com

This command will download the file. download.php and after accessing it you will see a flag on your desktop. Use with sudo , because it may not work.
Greetings mr.None

1 Like

Someone send the flag, idk why my connection to the server is being blocked which never happened and I cant complete the module

did u try using vim to read the download.php file, when downloaded?

Thanks, this gave me the solution.

Fast solution:

  1. Copy the targhet (ex: Target(s): 83.136.250.140:52499 )
  2. use the command " curl -0 83.136.250.140:52499/download.php | cat "
    This will automatically show the flag in terminal :grinning:

It’s still ain’t working im going hella crazy

404 Not Found

Not Found

The requested URL was not found on this server.


Apache/2.4.41 (Ubuntu) Server at 94.237.53.117 Port 35565 [quote="Egorello, post:1, topic:254277, full:true"] Hi! I downloaded this file and didn't find the flag:

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="https://inlanefreight.com/download.php&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;
<hr>
<address>Apache/2.4.29 (Ubuntu) Server at inlanefreight.com Port 80</address>
</body></html>

Where is the flag here?
[/quote]
this is error for me