Highlighted writeups
CTF
Share
HITCON CTF Quals 2023. Shamir Secret Sharing. Lagrange interpolation. Chinese Remainder Theorem.
multiprocessing
Recent HTB
HTB
Titanic
Hack The Box. Linux. Easy machine. This machine has a Local File Read vulnerability where we can read sensitive files. There is a Gitea instance with some repositories and a Docker configuration that shows how Gitea files are shared in a volume mount. So, we can find hashed passwords on the Gitea SQLite database and crack them. With this, we gain access via SSH reusing credentials. After that, we find a script running asroot using a vulnerable version of ImageMagick where we can perform a library hijacking to get arbitrary code execution, as root
HTB
Alert
Hack The Box. Linux. Easy machine. This machine allows to render Markdown files and share them with a unique link. The Markdown viewer is vulnerable to XSS, and we can send a link to the administrator to perform CSRF and read a confidential webpage. Besides, we find a Local File Read vulnerability, and we can find an.htpasswd file with a hashed password to access another subdomain. Instead, we can crack the hash and reuse the password for SSH. At this point, there is a local PHP server running as root, and we are able to manage PHP scripts, so we can simply execute PHP code as root
HTB
Bizness
Hack The Box. Linux. Easy machine. This machine has a vulnerable version of Apache OFBiz that can be exploited to get RCE using an authentication bypass and Java deserialization payload. Once on the machine, we can inspect the database and search for the password hash of the administrator user. Once the hash is cracked, we can reuse the password and gain access asroot
HTB
RegistryTwo
Hack The Box. Linux. Insane machine. This machine exposes a web application that allows to create custom domains with HTML code. Moreover, there is a Docker registry exposed where we can download Docker image blobs after getting a suitable JWT token. The web application is running a WAR file with Tomcat, we can decompile it and see that it queries a RMI server. Since Tomcat is behind an nginx reverse proxy, we can access some sensitive Tomcat servlets to modify our session and set manager permissions on the web application. We need this to modify the RMI configuration using a mass assignment vulnerability and point the RMI server to us. After that, we can exploit an insecure deserialization vulnerability in Java to get RCE in a container. Then, we can interact with the legitimate RMI server using port forwarding. This server allows us to read arbitrary files with a directory traversal attack. We can find a plaintext password for userdeveloper, which is reused in SSH. Then, root is executing a JAR file to analyze files of the hosting website by sending them to a ClamAV server. The problem here is that the JAR calls functions from the RMI register, which is restarted periodically. Therefore, we can craft a malicious RMI registry and exploit win a race condition to take the port, so that root queries our malicious registry and talks to our fake ClamAV server. The result is that all files at /root will be quarantined inside a readable directory, which leads to the privilege escalation
HTB
Sau
Hack The Box. Linux. Easy machine. This machine has a web application that is vulnerable to SSRF, which can be used to read the contents of an internal server, which is vulnerable to command injection. The two vulnerabilities can be chained to get RCE on the machine. The low-privileged user is able to runsystemctl as root using sudo, which leads to the privilege escalation via the default pager lessRecent IMC
IMC
IMC 2021, Problem 1
Let
- Prove that there is a unique real
matrix that satisfies the equation - Express
in terms of .
IMC
IMC 2019, Problem 7
Let
IMC
IMC 2019, Problem 5
Determine whether there exist an odd positive integer
. . .