tsustyle

Red Team Aspirant

Warm Up

less than 1 minute read

img

img

Loose comparison. Only the value is checked, not the type of the variable.

https://github.com/spaze/hashes/blob/master/README.md

sha1 of 10932435112 = 0E07766915004133176347055865026311692244

sha1 of aaroZmOk = 0E66507019969427134894567494305185566735

That’ll do, pig.

http://chall.csivit.com:30272/?hash=aaroZmOk

csictf{typ3_juggl1ng_1n_php}

You may also enjoy

Tenet

 

‘Tenet’ is a medium rated box on Hack the Box. We’ll be using PHP Object Injection to get RCE and identify a race condition in a custom script for privesc.

Skynet

 

‘Skynet’ is a box on TryHackMe. We’ll be enumerating SMB shares, brute forcing a login and exploiting a Remote File Inclusion vulnerability in Cuppa CMS for a foothold. For our root shell we’ll take a look at exploiting some wildcard injection using a script that’s being run as a cronjob.

FFuF Cheatsheet

 

This is a Cheatsheet I created for reference when using FFuF

Ready

 

‘Ready’ is a medium rated box on Hack the Box. We’ll be using a public exploit for a vulnerable Gitlab version for a shell, enumeration and password reuse for privesc and escape a docker container for root