Include - Easy¶
By updating the guest profiles activity we can update the isAdmin field to true.
After a refresh we see a new menu called API.
Opening this we get some secrets:
Internal API GET http://127.0.0.1:5000/internal-api HTTP/1.1
Host: 127.0.0.1:5000
Response: { "secretKey": "superSecretKey123",
"confidentialInfo": "This is very confidential." }
Get Admins API
GET http://127.0.0.1:5000/getAllAdmins101099991 HTTP/1.1
Host: 127.0.0.1:5000
Response: { ``"ReviewAppUsername": "admin",``
"ReviewAppPassword": "xxxxxx",
"SysMonAppUsername": "administrator",
"SysMonAppPassword": "xxxxxxxxx", }
By passing that API endpoint URL into the banner upload we are able to call the localhost and we get some b64 encoded string, decoding we get creds
This was a SSRF (Server side request forgery) we exploited the servers access and permissions to the endpoint to output the content of the response where the banner normally is.
We can get the first flag by going to port 50000 and using the sysmon creds we found.
From here I open the page source and notice the administrators profile picture is loaded from a php script and pulls a png directly from the server. We can use a LFI bypass to get /etc/passwd.
From there we find a user called joshua and charles. I will crack Josh’s password with this command:
hydra -l joshua -P /usr/share/wordlists/fasttrack.txt 10.64.185.243 ssh
And we get the password 123456, this should give us SSH. Now just go to the path we get in the description of the challenge:
boom. pwned