I took abit of a rage-quit break, but I’m back now! I ended up finding the localhost site, and port forwarded using ssh -L, but I’m still stuck ■■■■
Any tips? Sorry for the dumb questions lollll
1 Like
rev shell is not working, I think the code is not even executing. Any way to check if the payload is working?
Hey, dude, can you pleeease help me on the root flag? I’m stuck! I got the user, and i found the localhost site, but i still have no clue where to go from here
1 Like
Well, What error is your browser giving you? What payload are you using?
I could try help find the error 
.cif exploit, browser is not the problem. The thing is when I click view, theres no connection. Already tried busybox and all type of shells
When you click view?
I’m guessing you are using CVE-2024-23346
The browser could help me narrow it down abit. For example some people are getting 502 errors, which would kinda help me see if its a problem with the browser or the payload!
DM the payload/files you are using to me in dms, ill test it abit and see if i can fix anything!
Yes using that CVE. Im getting error 500 after clicking view. Let me send you the payload.
Have you enumerated the localhost website itself?
Did you find any interesting paths or sub directories?
Maybe Nmap might help you find things you overlooked.
can someone help me i sent the file.cif with the payload but it doesn’t work
Finnally
google → file.cif vulnerability
number CVE github
edit exploit
this should work
rooted
I’ve been doing that with different payloads, but it doesn’t work, I don’t know if it’s because the machine is bug or is my error
Google → cif file exploit
number CVE github
second entry is very representative 
it worked for me
Hello I can’t seem to get my cif file to work it seems to spin infintely then do nothing? Would anyone be abke to help?
idk why but i have tried lots of shells and nothing is working, is it a box issue ?
Im having a simmilar issue
Finally got it. Issue for me with the payload to get the foothold was that I was entering the wrong IP address. Doh.
Hello, I found an xss flaw in the site to see the list of services, but I don’t understand what I can do with it, am I on the right path at least ?
Hi.
I obtained reverse shell but i can`t read data of the user. “cat user.txt”
As if it were empty.