Newsletter 16/10/2023
This machine has a website with an API that is vulnerable to second-order SQLi. Then, there is an authentication mechanism that just requires the password hash, so we can take a hash from the dumped database and log in as an administrator. Then, there is a vulnerability involving PHP and ImageMagick that leads to RCE. Once in the machine, we can pivot to user greg by analyzing a Git repository and finding plaintext credentials. After that, we are allowed to run a custom binary that hashes a given length of a file and compares the result with a set of pre-computed MD5 hashes. This binary has a capability that allows to read files as root, which can be used to extract all the contents of any file after automating the process, which allows to read an SSH private key for root
Key written in a binary. Bypassing with GDB
Flask. Server-Side Template Injection. RCE
Node.js. JWT. Prototype Pollution
RSA. Euler totient function
RSA. Quaternions. GCD
Directory Traversal. Symbolic links. File descriptors
64-bit binary. Buffer Overflow. ROP
pickle. RSA. CBC mode
Shamir Secret Sharing. Lagrange interpolation. Chinese Remainder Theorem. multiprocessing
Padding Oracle Attack. Custom padding. Guessing