Official Download Discussion

HTB Content Machines
124

can you help me to get root flag?

125

I was thinking about the filename in upload requestā€¦

126

Iā€™m struggling to get the payload working for user. I keep getting 502 errors.

Help would be appreciated if anyone is free.

127

if you check any of the requests to the site there is a header that tells you the framework behind this app
then Iā€™d suggest using a tool like dotdotpwn

128

is someone up for foothold?

129

The monster is not strictly necessary, it just happens to be reliable and one of the few already existing tools that do what it does. Itā€™s feasible and probably would have been much faster to write something more tailor fit, but I just used the monster in an embarrassingly messy hodgepodge way to get my end result.

131

You can DM, explain what you did and where you are stuck. I can and will answer but a tad bit later; thus, expect delays. Or hit me up on discord.

And to the above questions, hope itā€™s not too much, no, no, no. Brute force the sig, LFI related to phpmyadmin, and no need for .env file.

132

I have done the cookie stuff, impersonate every userā€¦ is the magic on any of the userā€™s files? Still have no idea on how having a shellā€¦ :thinking:

1 Like
133

Can I get a nudge on how to find the LFI. It really isnā€™t jumping out at me even though it sounds like it is easy.

1 Like
134
136

useless files. focus on the attack vector instead. what else is stored?

137

easy machine :slight_smile:

138

Iā€™m stuck in getting foothold. Can someone give me a hint?

140

I was wondering how to use the power of the monster after acquiring it, but thanks to @tec I knew the way to go and got the user.

141

Nah, I didnā€™t use the monster. Made my own tool using what I had already discovered by that point.

142

I found a possible LFI in upload packet, but I canā€™t find any header who indicates the framework behind this app. Anyway, I already found it using wappylyzer, it is Express right?

143

Right.

Read the title!

1 Like
144

So I must inspect download packet, It seems to me that there is nothing strange

145

Can someone help me with the last user part ? Iā€™ve read other users files but donā€™t know how to reach something else.

146

Might wanna look into directory traversal.